CVE-2022-23959: Debian Linux

Critical severity, CVSS 9.1. EPSS: 2% chance of exploitation in the next 30 days.

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only
• Varnish-Software Varnich Cache: from 1.0.0, before 6.6.2 (fixed in 6.6.2); from 4.1.1, before 4.1.11r6 (fixed in 4.1.11r6); version 4.1 only
• Varnish-Software Varnish Cache: from 6.0.0, before 6.0.10 (fixed in 6.0.10)
• Varnish-Software Varnish Cache Plus: from 6.0.0, before 6.0.9r4 (fixed in 6.0.9r4)
• Varnish Cache Project Varnish Cache: from 7.0.0, before 7.0.2 (fixed in 7.0.2)

Published 2022-01-26. Last modified 2026-06-17.