Your submission was sent successfully! Close

CVE-2021-36740

Published: 14 July 2021

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

Priority

Medium

CVSS 3 base score: 6.5

Status

Package Release Status
varnish
Launchpad, Ubuntu, Debian
bionic Not vulnerable

focal
Released (6.2.1-2ubuntu0.1)
groovy Ignored
(reached end-of-life)
hirsute Ignored
(reached end-of-life)
impish
Released (6.5.2-1)
jammy Not vulnerable
(6.5.2-1)
trusty Not vulnerable

upstream Needs triage

xenial Ignored
(out of standard support)