Read the docs
TI-2024-19907 Aliases CVE-2024-30156GHSA-c3wj-m54r-wfgq

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish…

Priority MEDIUM 45CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03663 89th percentileScored 2026-11-07
Fix Fixed Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

Red Hat 9 advisories

  • RHSA-2024:4937 Released 2024-07-31 · Red Hat rating Important
    varnish:6 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) varnish-6.0.6-1.module+el8.2.0+22154+6b906702.src::varnish:6, varnish-6.0.6-1.module+el8.2.0+22154+6b906702.x86_64::varnish:6, varnish-devel-6.0.6-1.module+el8.2.0+22154+6b906702.x86_64::varnish:6 +3
  • RHSA-2024:3426 Released 2024-05-28 · Red Hat rating Important
    varnish:6 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) varnish-6.0.8-2.module+el8.6.0+21852+17475f6a.3.aarch64::varnish:6, varnish-6.0.8-2.module+el8.6.0+21852+17475f6a.3.ppc64le::varnish:6, varnish-6.0.8-2.module+el8.6.0+21852+17475f6a.3.s390x::varnish:6 +15
  • RHSA-2024:3305 Released 2024-05-23 · Red Hat rating Important
    varnish:6 security update
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) varnish-6.0.8-3.module+el8.8.0+21796+79393093.2.aarch64::varnish:6, varnish-6.0.8-3.module+el8.8.0+21796+79393093.2.ppc64le::varnish:6, varnish-6.0.8-3.module+el8.8.0+21796+79393093.2.s390x::varnish:6 +15
Show 6 more Red Hat advisories
  • RHSA-2024:2938 Released 2024-05-21 · Red Hat rating Important
    varnish:6 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6, varnish-devel-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6 +3
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.ppc64le::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6 +7
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.src::varnish:6, varnish-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6, varnish-devel-6.0.6-2.module+el8.4.0+21799+2c737c67.5.x86_64::varnish:6 +3
  • RHSA-2024:2820 Released 2024-05-13 · Red Hat rating Important
    varnish security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) varnish-devel-6.6.2-3.el9_2.2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) varnish-6.6.2-3.el9_2.2, varnish-docs-6.6.2-3.el9_2.2
  • RHSA-2024:2700 Released 2024-05-06 · Red Hat rating Important
    varnish security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) varnish-devel-6.6.2-2.el9_0.3
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) varnish-6.6.2-2.el9_0.3, varnish-docs-6.6.2-2.el9_0.3
  • RHSA-2024:1690 Released 2024-04-08 · Red Hat rating Important
    varnish security update
    • Red Hat Enterprise Linux AppStream (v. 8) varnish-6.0.13-1.module+el8.9.0+21617+7578fa11.aarch64::varnish:6, varnish-6.0.13-1.module+el8.9.0+21617+7578fa11.ppc64le::varnish:6, varnish-6.0.13-1.module+el8.9.0+21617+7578fa11.s390x::varnish:6 +15
  • RHSA-2024:1691 Released 2024-04-08 · Red Hat rating Important
    varnish security update
    • Red Hat CodeReady Linux Builder (v. 9) varnish-devel-6.6.2-4.el9_3.1
    • Red Hat Enterprise Linux AppStream (v. 9) varnish-6.6.2-4.el9_3.1, varnish-docs-6.6.2-4.el9_3.1
  • RHSA-2024:1689 Released 2024-04-08 · Red Hat rating Important
    rh-varnish6-varnish security update
    • Red Hat Software Collections for RHEL Workstation(v. 7) rh-varnish6-varnish-6.0.13-1.el7, rh-varnish6-varnish-devel-6.0.13-1.el7, rh-varnish6-varnish-docs-6.0.13-1.el7 +2
    • Red Hat Software Collections for RHEL(v. 7) rh-varnish6-varnish-6.0.13-1.el7, rh-varnish6-varnish-devel-6.0.13-1.el7, rh-varnish6-varnish-docs-6.0.13-1.el7 +2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:1691
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:2700
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:2820
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:1690
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1691
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:4937
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:2938
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:2938
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:3426
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:3305
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:2700
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:2820
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:2938
Red Hat Software Collections for RHEL Workstation(v. 7)Fixed RHSA-2024:1689
Red Hat Software Collections for RHEL(v. 7)Fixed RHSA-2024:1689
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 9
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-30156
  2. 2026-10-03 Alias added: GHSA-c3wj-m54r-wfgq

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences