Most recent entries from all

ALSA-2024:1690 — Important: varnish security update

Affected: AlmaLinux:8: varnish, AlmaLinux:8: varnish-devel, AlmaLinux:8: varnish-docs, AlmaLinux:8: varnish-modules

Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

* varnish: HTTP/2 Broken Window Attack may result in denial of service (CVE-2024-30156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-03246

EUVD-2026-203439

fkie_cve-2024-30156

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

GHSA-c3wj-m54r-wfgq

gsd-2024-30156

OESA-2024-1415 — varnish security update

Affected: openEuler:20.03-LTS-SP1: varnish, openEuler:20.03-LTS-SP4: varnish, openEuler:22.03-LTS: varnish, openEuler:22.03-LTS-SP1: varnish, openEuler:22.03-LTS-SP2: varnish, openEuler:22.03-LTS-SP3: varnish

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture. Security Fix(es): Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.(CVE-2024-30156)

RHSA-2024:1689 — Red Hat Security Advisory: rh-varnish6-varnish security update

varnish: HTTP/2 Broken Window Attack may result in denial of service

RHSA-2024:1690 — Red Hat Security Advisory: varnish security update

varnish: HTTP/2 Broken Window Attack may result in denial of service

UBUNTU-CVE-2024-30156

Affected: Ubuntu:22.04:LTS: varnish, Ubuntu:24.04:LTS: varnish

WID-SEC-W-2024-0701 — Varnish HTTP Cache: Schwachstelle ermöglicht Denial of Service

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Varnish HTTP Cache ausnutzen, um einen Denial of Service Angriff durchzuführen.