CVE catalog

CVE-2022-23959

varnish: CVE-2022-23959

Severity: Critical · CVSS 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Jan 25, 2022, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.01% · Oct 25, 2026

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	varnish	trixie	`7.7.0-3+deb13u1`	fixed
Debian	varnish	trixie-security	`7.7.0-3+deb13u2`	fixed
Debian	varnish	bookworm	`7.1.1-2+deb12u1`	fixed
Debian	varnish	bookworm-security	`7.1.1-2+deb12u1`	fixed
Opensuse	varnish	tumbleweed	`7.1.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	varnish	source	trixie	`7.1.0-5`	not yet assigned	Not reported	[1004433]
Debian	varnish	source	bookworm	`7.1.0-5`	not yet assigned	Not reported	[1004433]
Opensuse	varnish	rpm	tumbleweed	`7.1.0-1.1`	Not reported	OPENSUSE-SU-2024:12086-1	Not reported

[Debian bug #1004433]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libvarnishapi3]Unknown
Source package: [varnish]
Details (4)
- 7.1.1-2+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
[libvarnishapi-dev]Unknown
Source package: [varnish]
Details (4)
- 7.1.1-2+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
[varnish]Unknown
Details (4)
- 7.1.1-2+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
[varnish-doc]Unknown
Source package: [varnish]
Details (4)
- 7.1.1-2+deb12u1 · all · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · all · bookworm
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · all · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · all · bookworm-security
  Fixed · Fixed: 7.1.0-5
  dsa · varnish · debian · bookworm

Observed: Oct 23, 2026, 6:24:43 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]