varnish-software vulnerabilities and threats

Varnish Cache version 9.0.0 contains a vulnerability that allows a denial of service via a workspace overflow leading to a daemon panic. This occurs when a malicious client sends an HTTP/1 request, waits for the session to release its worker thread (timeout_linger), and then resumes traffic before the session closes (timeout_idle), sending multiple requests simultaneously to trigger pipelining. The issue stems from incomplete handling of workspace rollback during pipelining, causing prefetched data to exceed workspace limits and crash the server.

Varnish Enterprise versions before 6.0.16r12 contain a vulnerability where the headerplus.write_req0() function can cause a workspace overflow leading to a daemon panic and server crash. This occurs when an amended request contains too many header fields, triggering a denial of service condition. The issue affects shared VCL deployments and can be exploited by malicious clients to disrupt service availability.

Varnish Cache versions prior to 9.0.1 and Varnish Enterprise before 6.0.16r11 contain a vulnerability that can cause a denial of service via a workspace overflow leading to a daemon panic. This occurs during the HTTP/2 session upgrade process when buffer allocation splits the original workspace, and certain amounts of prefetched data cause pipelining operations to exhaust the workspace. The vulnerability is identified as CWE-670, relating to always-incorrect control flow implementation.

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.