Inconsistent interpretation of HTTP requests in Varnish Cache - CVE-2021-36740

Detailed vulnerability description

The vulnerability allows a remote attacker to preform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP/2 requests. A remote attacker can send a specially crafted HTTP/2 POST request with a large Content-Length header to the server and smuggle arbitrary HTTP headers.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache or bypass VCL authorization.

How to mitigate CVE-2021-36740

Sources

• https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be
• https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf
• https://docs.varnish-software.com/security/VSV00007/
• https://varnish-cache.org/security/VSV00007.html