Packages / Debian 13 (Trixie) / Source / libs / varnish

Source Package: varnish (7.7.0-3+deb13u2)

shared libraries for Varnish

The following binary packages are built from this source package:

libvarnishapi3
shared libraries for Varnish
libvarnishapi-dev
development files for Varnish
varnish-doc
documentation for Varnish Cache

Known vulnerabilities

Matching against OpenFactory catalog package versions is in progress.

CVE	Severity	Version impact
[CVE-2026-93894] Published: Sep 16, 2026, 10:00:00 PM UTC In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to m	Low(2.3)	Affected Details (15) `7.7.0-3+deb13u1` · amd64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · all · trixie-security Fixed · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13
[CVE-2026-34475] Published: Mar 16, 2026, 11:00:00 PM UTC Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or auth	Medium(5.4)	Affected Details (15) `7.7.0-3+deb13u1` · amd64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · all · trixie-security Fixed · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Affected · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u2` nvd · varnish · debian · 13
[CVE-2021-36740] Published: Jul 13, 2021, 12:00:00 AM UTC varnish: CVE-2021-36740	High(8.1)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:58:56 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.5.2-1` dsa · varnish · debian · 13
[CVE-2019-20637] Published: Apr 8, 2020, 11:15:00 PM UTC varnish: CVE-2019-20637	High(7.5)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:43:49 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13
[CVE-2020-11653] Published: Apr 8, 2020, 11:15:00 PM UTC varnish: CVE-2020-11653	High(7.5)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:46:56 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.4.0-1` dsa · varnish · debian · 13
[CVE-2013-4090] Published: Feb 12, 2020, 4:15:10 PM UTC varnish: CVE-2013-4090	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:08:24 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `3.0.4-1` dsa · varnish · debian · 13
[CVE-2019-15892] Published: Sep 3, 2019, 12:00:00 AM UTC varnish: CVE-2019-15892	High(7.5)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:41:05 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `6.2.1-1` dsa · varnish · debian · 13
[CVE-2017-8807] Published: Nov 15, 2017, 12:00:00 AM UTC varnish: CVE-2017-8807	Medium(5.3)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:31:38 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `5.2.1-1` dsa · varnish · debian · 13
[CVE-2017-12425] Published: Aug 2, 2017, 12:00:00 AM UTC varnish: CVE-2017-12425	Medium(5.3)	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:26:06 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `5.0.0-7.1` dsa · varnish · debian · 13
[CVE-2015-8852] Published: Apr 21, 2016, 12:00:00 AM UTC varnish: CVE-2015-8852	Medium	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:17:27 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `4.0.0-1` dsa · varnish · debian · 13
[CVE-2013-4484] Published: Nov 1, 2013, 2:55:00 AM UTC varnish: CVE-2013-4484	High	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:08:44 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `3.0.5-1` dsa · varnish · debian · 13
[CVE-2009-2936] Published: Apr 5, 2010, 4:30:00 PM UTC varnish: CVE-2009-2936	Low	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:04:38 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `2.1.0-2` dsa · varnish · debian · 13
[CVE-2009-4488] Published: Jan 13, 2010, 8:30:00 PM UTC varnish: CVE-2009-4488	Low	Unknown Matching against OpenFactory catalog package versions is in progress. Observed: Oct 23, 2026, 5:04:45 PM UTC Details (12) `7.7.0-3+deb13u1` · amd64 · trixie Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Affected dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Affected dsa · varnish · debian · 13

Fixed and unaffected versions (4)

CVE	Severity	Version impact
[CVE-2026-50052] Published: May 18, 2026, 10:00:00 PM UTC In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be	Low(2.3)	Fixed Details (15) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · all · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` nvd · varnish · debian · 13
[CVE-2025-8671] Published: Aug 13, 2025, 12:03:37 PM UTC DNSdist vulnerabilities	High(7.5)	Fixed Details (15) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u2` · all · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-3+deb13u1` usn · varnish · debian · 13
[CVE-2025-47905] Published: May 12, 2025, 10:00:00 PM UTC varnish: CVE-2025-47905	High(8.1)	Fixed Details (15) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u2` · all · trixie-security Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-2` dsa · varnish · debian · 13
[CVE-2025-30346] Published: Mar 18, 2025, 11:00:00 PM UTC varnish: CVE-2025-30346	Medium(5.4)	Fixed Details (15) `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · all · trixie-security · Historical version Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u2` · all · trixie-security Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · amd64 · trixie-security · Historical version Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u1` · arm64 · trixie-security Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13 `7.7.0-3+deb13u2` · amd64 · trixie-security Fixed · Fixed: `7.7.0-1` dsa · varnish · debian · 13

Last synced: Oct 28, 2026, 1:40:02 AM UTC

[CVE catalog]

Sources

Debian 13 (Trixie) main amd64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Observed SHA-256
3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
Result
match verified
Debian 13 (Trixie) main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Repository-signature verification record
Signed object
https://deb.debian.org/debian/dists/trixie/InRelease
Signed-object SHA-256
98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
Signer fingerprint
4CB50190207B4758A3F73A796ED0E7B82643E131
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Observed SHA-256
753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
Result
match verified
Debian 13 (Trixie) security main arm64Sep 1, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-arm64:a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
fb4f5284b755510aafc1d8a39ef966c7ef714aaab3ecc24baae0a67c38518ab5
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Repository metadata hash linkage
Path
main/binary-arm64/Packages.xz
Expected SHA-256
a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Observed SHA-256
a1606cb4e67822be93a6484199cd3ca52e27a8be038314abcac98bbd484c43d8
Result
match verified
Debian SecurityOct 24, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-amd64:c7fc2c6a79fa6288ed4389753dddee83cab791b3b9535ef21d9cfebde1aba2fb
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
57ffec84de1b8660b9a20cad0f1de223d55489d0df4b6318eb6c68a5585f2f92
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Oct 25, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
c7fc2c6a79fa6288ed4389753dddee83cab791b3b9535ef21d9cfebde1aba2fb
Observed SHA-256
c7fc2c6a79fa6288ed4389753dddee83cab791b3b9535ef21d9cfebde1aba2fb
Result
match verified
Debian SecurityOct 27, 2026
Authoritative source; repository metadata signature verified
Signature evidence
trixie-security-main-amd64:cbc4bef76e3c37ead4980674b88d8b1cd971e3ef018f45488da6b988f55946f3
Repository-signature verification record
Signed object
https://security.debian.org/debian-security/dists/trixie-security/InRelease
Signed-object SHA-256
e7fa27c6347540f93dc90c68b4361e02148fc15bdd516a816d6f56449c3c3baf
Signer fingerprint
B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
Keyring revision
debian-archive-keyring.gpg
SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
Tool and policy
gpgv (GnuPG) 2.4.9
openfactory-software-catalog-signature-v1
Verification time
Oct 28, 2026
Repository metadata hash linkage
Path
main/binary-amd64/Packages.xz
Expected SHA-256
cbc4bef76e3c37ead4980674b88d8b1cd971e3ef018f45488da6b988f55946f3
Observed SHA-256
cbc4bef76e3c37ead4980674b88d8b1cd971e3ef018f45488da6b988f55946f3
Result
match verified