Red Hat Security AdvisoryRHSA-2025:8310
varnish:6 security update
Released 2025-05-29 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.6) varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.src::varnish:6, varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.x86_64::varnish:6, varnish-devel-6.0.8-2.module+el8.6.0+23122+0639db89.4.x86_64::varnish:6 +3
- Red Hat Enterprise Linux AppStream E4S (v.8.6) varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.aarch64::varnish:6, varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.ppc64le::varnish:6, varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.s390x::varnish:6 +15
- Red Hat Enterprise Linux AppStream TUS (v.8.6) varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.src::varnish:6, varnish-6.0.8-2.module+el8.6.0+23122+0639db89.4.x86_64::varnish:6, varnish-devel-6.0.8-2.module+el8.6.0+23122+0639db89.4.x86_64::varnish:6 +3
Fixes 1 record
Priority LOW 25
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundari…
CVSS 3.1MEDIUM 5.4· Network · No auth · No interaction · EPSS 0.00367 · Published 2025-05-13 · Fixed in 6.0.14 LTS, 7.6.3 +1 CWE-444
