An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7…
Priority LOW 37CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.
Why it matters now
EPSS 0.02416 84th percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 34
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:varnish-cache:varnish:4.0.2:rc-1:*:*:*:*:*:* | 4.0.2 rc-1 | Vulnerable | Varnish-cache |
| cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-1:*:*:*:*:*:* | 4.0.3 rc-1 | Vulnerable | Varnish-cache |
| cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-2:*:*:*:*:*:* | 4.0.3 rc-2 | Vulnerable | Varnish-cache |
| cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-2-proper:*:*:*:*:*:* | 4.0.3 rc-2-proper | Vulnerable | Varnish-cache |
| cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-3:*:*:*:*:*:* | 4.0.3 rc-3 | Vulnerable | Varnish-cache |
| cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.1:*:*:*:*:*:*:* | 4.0.1 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.2:*:*:*:*:*:*:* | 4.0.2 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.3:*:*:*:*:*:*:* | 4.0.3 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.4:*:*:*:*:*:*:* | 4.0.4 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish-cache:varnish:4.1.0:*:*:*:*:*:*:* | 4.1.0 | Vulnerable | Varnish-cache |
- cpe:2.3:a:varnish-cache:varnish:4.0.2:rc-1:*:*:*:*:*:* Versions 4.0.2 rc-1 Vulnerable ·Varnish-cache
- cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-1:*:*:*:*:*:* Versions 4.0.3 rc-1 Vulnerable ·Varnish-cache
- cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-2:*:*:*:*:*:* Versions 4.0.3 rc-2 Vulnerable ·Varnish-cache
- cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-2-proper:*:*:*:*:*:* Versions 4.0.3 rc-2-proper Vulnerable ·Varnish-cache
- cpe:2.3:a:varnish-cache:varnish:4.0.3:rc-3:*:*:*:*:*:* Versions 4.0.3 rc-3 Vulnerable ·Varnish-cache
- cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish_cache_project:varnish_cache:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish-cache:varnish:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Varnish-cache
Show 24 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:varnish-software:varnish_cache:4.1.0:beta1:*:*:*:*:*:* | 4.1.0 beta1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.0:technology_preview1:*:*:*:*:*:* | 4.1.0 technology_preview1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.1:*:*:*:*:*:*:* | 4.1.1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.1:beta1:*:*:*:*:*:* | 4.1.1 beta1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.1:beta2:*:*:*:*:*:* | 4.1.1 beta2 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.2:*:*:*:*:*:*:* | 4.1.2 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.2:beta1:*:*:*:*:*:* | 4.1.2 beta1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.2:beta2:*:*:*:*:*:* | 4.1.2 beta2 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.3:*:*:*:*:*:*:* | 4.1.3 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.3:beta1:*:*:*:*:*:* | 4.1.3 beta1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.3:beta2:*:*:*:*:*:* | 4.1.3 beta2 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.4:*:*:*:*:*:*:* | 4.1.4 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.4:beta1:*:*:*:*:*:* | 4.1.4 beta1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.4:beta2:*:*:*:*:*:* | 4.1.4 beta2 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.4:beta3:*:*:*:*:*:* | 4.1.4 beta3 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.5:*:*:*:*:*:*:* | 4.1.5 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.5:beta1:*:*:*:*:*:* | 4.1.5 beta1 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.5:beta2:*:*:*:*:*:* | 4.1.5 beta2 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.6:*:*:*:*:*:*:* | 4.1.6 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish-software:varnish_cache:4.1.7:*:*:*:*:*:*:* | 4.1.7 | Vulnerable | varnish-software |
| cpe:2.3:a:varnish_cache_project:varnish_cache:5.0.0:*:*:*:*:*:*:* | 5.0.0 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish_cache_project:varnish_cache:5.1.0:*:*:*:*:*:*:* | 5.1.0 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish_cache_project:varnish_cache:5.1.1:*:*:*:*:*:*:* | 5.1.1 | Vulnerable | Varnish Cache Project |
| cpe:2.3:a:varnish_cache_project:varnish_cache:5.1.2:*:*:*:*:*:*:* | 5.1.2 | Vulnerable | Varnish Cache Project |
- cpe:2.3:a:varnish-software:varnish_cache:4.1.0:beta1:*:*:*:*:*:* Versions 4.1.0 beta1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.0:technology_preview1:*:*:*:*:*:* Versions 4.1.0 technology_preview1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.1:beta1:*:*:*:*:*:* Versions 4.1.1 beta1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.1:beta2:*:*:*:*:*:* Versions 4.1.1 beta2 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.2:beta1:*:*:*:*:*:* Versions 4.1.2 beta1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.2:beta2:*:*:*:*:*:* Versions 4.1.2 beta2 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.3:beta1:*:*:*:*:*:* Versions 4.1.3 beta1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.3:beta2:*:*:*:*:*:* Versions 4.1.3 beta2 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.4:beta1:*:*:*:*:*:* Versions 4.1.4 beta1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.4:beta2:*:*:*:*:*:* Versions 4.1.4 beta2 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.4:beta3:*:*:*:*:*:* Versions 4.1.4 beta3 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.5:*:*:*:*:*:*:* Versions 4.1.5 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.5:beta1:*:*:*:*:*:* Versions 4.1.5 beta1 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.5:beta2:*:*:*:*:*:* Versions 4.1.5 beta2 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.6:*:*:*:*:*:*:* Versions 4.1.6 Vulnerable ·varnish-software
- cpe:2.3:a:varnish-software:varnish_cache:4.1.7:*:*:*:*:*:*:* Versions 4.1.7 Vulnerable ·varnish-software
- cpe:2.3:a:varnish_cache_project:varnish_cache:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish_cache_project:varnish_cache:5.1.0:*:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish_cache_project:varnish_cache:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·Varnish Cache Project
- cpe:2.3:a:varnish_cache_project:varnish_cache:5.1.2:*:*:*:*:*:*:* Versions 5.1.2 Vulnerable ·Varnish Cache Project
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12425
- 2026-10-03 Alias added: GHSA-jhqh-84v8-3cw2
References
Advisory 6
Sources
- CVE-2017-12425 · CVE Program
- CVE-2017-12425 · NVD
- FIRST EPSS
- GHSA-jhqh-84v8-3cw2 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-12425 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences