Red Hat Security AdvisoryRHSA-2025:8340
varnish:6 security update
Released 2025-06-02 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream AUS (v.8.4) varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.x86_64::varnish:6, varnish-devel-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.x86_64::varnish:6 +3
- Red Hat Enterprise Linux AppStream E4S (v.8.4) varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.ppc64le::varnish:6, varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.x86_64::varnish:6 +7
- Red Hat Enterprise Linux AppStream TUS (v.8.4) varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.x86_64::varnish:6, varnish-devel-6.0.6-2.module+el8.4.0+23123+54dbaab7.6.x86_64::varnish:6 +3
Fixes 1 record
Priority LOW 25
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundari…
CVSS 3.1MEDIUM 5.4· Network · No auth · No interaction · EPSS 0.00367 · Published 2025-05-13 · Fixed in 6.0.14 LTS, 7.6.3 +1 CWE-444
