CVE-2021-36740: Debian Linux

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Varnish-Cache Varnish Cache: from 6.0.0, before 6.0.8 (fixed in 6.0.8); version 6.0.8 only
• Varnish-Software Varnish Cache: from 6.0.0, up to and including 6.0.5; from 6.0.0, up to and including 6.0.7
• Varnish Cache Project Varnish Cache: from 5.0.0, up to and including 5.2.1; from 6.1.0, up to and including 6.6.0

Published 2021-07-14. Last modified 2026-06-17.