Known vulnerabilities in Varnish Cache

Software: Varnish Cache
Software CPE: cpe:2.3:a:varnish:varnish_cache:*:*:*:*:*:*:*:*
Total vulnerabilities: 19
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Varnish Cache Varnish Cache is affected by 19 known vulnerabilities: 1 high, 17 medium, 1 low Critical High Medium Low

Vulnerabilities (19)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU132033 - Improper input validation
CWE-20 High
No
No
6.0.18, 8.0.2, 9.0.3 21.05.2026 SB2026052122
#VU124839 - Improper input validation
CWE-20 Medium
No
No
6.0.17, 8.0.1 02.04.2026 SB2026040259
#VU114024 - Resource exhaustion
CVE-2025-48989
CWE-400 Medium
No
No
6.0.15, 7.6.4, 7.7.2 13.08.2025 SB2025081375
SB2025081376
SB20250820127
and 49 more
#VU109043 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2025-47905
CWE-444 Medium
No
No
6.0.14, 7.6.3, 7.7.1 13.05.2025 SB2025051363
SB20250521114
SB2025052335
and 11 more
#VU105850 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2025-30346
CWE-444 Medium
No
No
7.6.2, 7.7.0 18.03.2025 SB2025031859
SB2025032567
SB2025032630
and 1 more
#VU88221 - Resource exhaustion
CVE-2024-30156
CWE-400 Medium
No
No
6.0.13, 7.3.2, 7.4.3 09.04.2024 SB2024040916
SB2024040925
SB2024040926
and 10 more
#VU79811 - Improper input validation
CWE-20 Medium
No
No
- 22.08.2023 SB2023082201
#VU69128 - Server-Side Request Forgery (SSRF)
CVE-2022-45060
CWE-918 Medium
No
No
6.0.11, 7.1.2, 7.2.1 08.11.2022 SB2022110886
SB2022112827
SB2022112828
and 17 more
#VU69126 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2022-45059
CWE-444 Medium
No
No
7.1.2, 7.2.1 08.11.2022 SB2022110886
SB2024031255
SB2024031256
and 4 more
#VU66219 - Reachable Assertion
CVE-2022-38150
CWE-617 Medium
No
No
7.0.3, 7.1.1 09.08.2022 SB2022080920
SB2022082551
SB2022081237
and 2 more
#VU60291 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2022-23959
CWE-444 Medium
No
No
6.0.10, 6.6.2, 7.0.2 03.02.2022 SB2022020331
SB2022020415
SB2022020416
and 14 more
#VU55501 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2021-36740
CWE-444 Medium
No
No
6.0.8, 6.5.2, 6.6.1 02.08.2021 SB2021080215
SB2021080216
SB2021080322
and 10 more
#VU30309 - Exposure of sensitive information to an unauthorized actor
CVE-2019-20637
CWE-200 Medium
No
No
6.0.5 09.04.2020 SB2020040932
SB2020061626
SB2020061628
and 2 more
#VU30310 - Improper input validation
CVE-2020-11653
CWE-20 Medium
No
No
6.0.6 09.04.2020 SB2020040933
SB2020061626
SB2020061628
and 3 more
#VU25016 - Reachable Assertion
CWE-617 Medium
No
No
6.0.6, 6.2.3, 6.3.2 07.02.2020 SB2020020618
#VU20865 - Integer overflow
CVE-2017-12425
CWE-190 Medium
No
No
4.0.5, 4.1.8, 5.1.3 04.09.2019 SB2017080404
SB2017081035
SB20170807103
and 4 more
#VU20864 - Missing release of memory after effective lifetime
CVE-2017-8807
CWE-401 Medium
No
No
4.1.9, 5.2.1 04.09.2019 SB2017111615
SB2017112601
SB2017112140
and 3 more
#VU20863 - Reachable Assertion
CVE-2019-15892
CWE-617 Low
No
No
6.0.4, 6.2.1 04.09.2019 SB2019090422
SB2019090603
SB2019092507
and 9 more
#VU32597 - Memory corruption
CVE-2013-4484
CWE-119 Medium
No
No
3.0.5 01.11.2013 SB2013110101
SB2013121307
SB2013112015
and 1 more