CVE-2022-45060: Debian Linux

High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days.

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Fedoraproject Fedora: version 35 only; version 36 only; version 37 only
• Varnish-Software Varnish Cache: from 6.0.0, before 6.0.11 (fixed in 6.0.11)
• Varnish-Software Varnish Cache Plus: version 6.0.0 only; version 6.0.1 only; version 6.0.2 only; version 6.0.3 only; version 6.0.4 only; version 6.0.5 only; …
• Varnish Cache Project Varnish Cache: from 5.0.0, before 6.0.11 (fixed in 6.0.11); from 7.0.0, before 7.1.2 (fixed in 7.1.2); version 7.2.0 only

Published 2022-11-09. Last modified 2026-06-17.