CVE-2022-38150: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.

Affected products

• Fedoraproject Fedora: version 35 only; version 36 only
• Varnish Cache Project Varnish Cache: version 7.0.0 only; version 7.0.1 only; version 7.0.2 only; version 7.1.0 only

Published 2022-08-11. Last modified 2026-06-17.