Description
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| varnish-software | Varnish Cache | 7.5.0 – < 7.6.2 | 7.6.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | varnish | 7.7.0-1 | — |
| Debian 12 | varnish | 7.1.1-2+deb12u1 | DSA-5918-1 |
| Debian 11 | varnish | 6.5.1-1+deb11u4 | DLA-4101-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | varnish | No fix yet | — |
| Ubuntu 14.04 LTS | varnish | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | varnish | No fix yet | — |
| Ubuntu Pro 20.04 LTS | varnish | No fix yet | — |
| Ubuntu Pro 18.04 LTS | varnish | No fix yet | — |
| Ubuntu Pro 16.04 LTS | varnish | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | varnish | 7.7.0-1.1 | openSUSE-SU-2025:14992-1 |
| openSUSE Tumbleweed | vinyl-cache | 9.0.0-1.1 | openSUSE-SU-2026:10751-1 |
| openSUSE Leap 16.0 | varnish | 7.7.3-bp160.1.1 | openSUSE-SU-2026:22131-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | varnish | 7.7.0-r0 | — |
| Alpine v3.23 | varnish | 7.7.0-r0 | — |
| Alpine v3.22 | varnish | 7.7.0-r0 | — |
| Alpine v3.21 | varnish | 7.6.3-r0 | — |
Advisories 6
- WID-SEC-2025-0585 Varnish HTTP Cache: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 20, 2026
- openSUSE-SU-2026:22131-1 Security update for varnish SUSE / openSUSE Security Updates · Oct 20, 2026
- openSUSE-SU-2026:10751-1 libvinylapi3-9.0.0-1.1 on GA media SUSE / openSUSE Security Updates · May 12, 2026
- DSA-5918-1 varnish - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4101-1 varnish - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2025:14992-1 libvarnishapi3-7.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026