FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

varnish -- Request Smuggling Vulnerability

Affected packages
	varnish6	<	6.6.2
	varnish4	<	4.1.11r6

Details

VuXML ID	b0c83e1a-8153-11ec-84f9-641c67a117d8
Discovery	2022-01-25
Entry	2022-01-29

Varnish Cache Project reports:

A request smuggling attack can be performed on HTTP/1 connections on Varnish Cache servers. The smuggled request would be treated as an additional request by the Varnish server, go through normal VCL processing, and injected as a spurious response on the client connection.

[source]

References

CVE Name	CVE-2022-23959
URL	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-23959
URL	https://docs.varnish-software.com/security/VSV00008/
URL	https://varnish-cache.org/security/VSV00008.html