Affected: AlmaLinux:8: varnish, AlmaLinux:8: varnish-devel, AlmaLinux:8: varnish-docs, AlmaLinux:8: varnish-modules

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

* varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Bitnami: varnish

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Affected: openEuler:22.03-LTS-SP4: varnish, openEuler:24.03-LTS: varnish, openEuler:24.03-LTS-SP1: varnish, openEuler:20.03-LTS-SP4: varnish, openEuler:22.03-LTS-SP3: varnish

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture. Security Fix(es):

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.(CVE-2025-47905)

varnish: request smuggling attacks

varnish: request smuggling attacks

Affected: Ubuntu:14.04:LTS: varnish, Ubuntu:Pro:16.04:LTS: varnish, Ubuntu:Pro:18.04:LTS: varnish, Ubuntu:Pro:20.04:LTS: varnish, Ubuntu:Pro:22.04:LTS: varnish, Ubuntu:24.04:LTS: varnish

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Ein Angreifer kann eine Schwachstelle in Varnish HTTP Cache ausnutzen, um Dateien zu manipulieren.