CVE-2022-23959

Name of the Vulnerable Software and Affected Versions Varnish Cache versions 6.0.0 through 6.6.1 Varnish Cache 6.0 LTS versions 6.0.0 through 6.0.9 Varnish Cache 7.x versions 7.0.0 through 7.0.1 Varnish Enterprise (Cache Plus) 4.1.x versions 4.1.0 through 4.1.11r5 Varnish Enterprise (Cache Plus) 6.0.x versions 6.0.0 through 6.0.9r3

Description Request smuggling can occur for HTTP/1 connections in the affected versions of Varnish Cache and Varnish Enterprise.

Recommendations For Varnish Cache versions 6.0.0 through 6.6.1, update to version 6.6.2 or later. For Varnish Cache 6.0 LTS versions 6.0.0 through 6.0.9, update to version 6.0.10 or later. For Varnish Cache 7.x versions 7.0.0 through 7.0.1, update to version 7.0.2 or later. For Varnish Enterprise (Cache Plus) 4.1.x versions 4.1.0 through 4.1.11r5, update to version 4.1.11r6 or later. For Varnish Enterprise (Cache Plus) 6.0.x versions 6.0.0 through 6.0.9r3, update to version 6.0.9r4 or later.