Read the docs
TI-2023-21726 Aliases CVE-2023-41104GHSA-rrpc-jfj4-37w9

libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an…

Priority LOW 36CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*6.0.0 to before 6.0.11Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:-:*:*:*:*:*:*6.0.11Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r1:*:*:*:*:*:*6.0.11 r1Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r2:*:*:*:*:*:*6.0.11 r2Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r3:*:*:*:*:*:*6.0.11 r3Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r4:*:*:*:*:*:*6.0.11 r4Vulnerablevarnish-software
cpe:2.3:a:varnish-software:vmod_digest:*:*:*:*:*:*:*:*before 1.0.3Vulnerablevarnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:* Versions 6.0.0 to before 6.0.11 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:-:*:*:*:*:*:* Versions 6.0.11 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r1:*:*:*:*:*:* Versions 6.0.11 r1 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r2:*:*:*:*:*:* Versions 6.0.11 r2 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r3:*:*:*:*:*:* Versions 6.0.11 r3 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r4:*:*:*:*:*:* Versions 6.0.11 r4 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:vmod_digest:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·varnish-software

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-41104
  2. 2026-10-03 Alias added: GHSA-rrpc-jfj4-37w9

References

Patch 1

Advisory 1

Other 1

  • TI-2026-26733 Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked… CVSS 3.1CRITICAL 9.8
  • TI-2025-21653 Out-of-bounds read in varnish-software Varnish Enterprise CVSS 3.1HIGH 7.5
  • TI-2026-29163 Resource allocation without limits in varnish-software Varnish Enterprise CVSS 3.1HIGH 7.5
  • TI-2026-29162 Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace… CVSS 3.1HIGH 7.5
  • TI-2025-21652 Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences