Varnish Cache
Varnish Cache is an HTTP accelerator designed to sit in front of origin servers and cache HTTP responses. It is widely deployed at the edge of web infrastructure for high-traffic sites. NVD tracks Varnish under two CPE namespaces reflecting a historical naming change; Attestd queries both and merges results on CVE ID.
Querying Varnish Cache
varnish7.4.2, 7.2.0, 6.6.2curl "https://api.attestd.io/v1/check?product=varnish&version=7.1.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Varnish 7.1.0 is affected by CVE-2022-45060 (HTTP/2 request smuggling). The aggregated response expects risk_state: "high".
{
"product": "varnish",
"version": "7.1.0",
"supported": true,
"risk_state": "high",
"risk_factors": [
"request_smuggling",
"internet_exposed_service",
"no_authentication_required",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "7.2.0",
"confidence": 0.8,
"cve_ids": ["CVE-2022-45060"],
"last_updated": "2026-02-23T18:21:30Z"
}Varnish 7.4.2 has no known relevant vulnerabilities at the time of the last synthesis run.
curl "https://api.attestd.io/v1/check?product=varnish&version=7.4.2" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Varnish CVEs cluster around HTTP request parsing and the HTTP/1.1 to HTTP/2 translation layer. Request smuggling vulnerabilities are the most operationally significant pattern, as they can allow attacker-controlled requests to bypass the cache layer and reach backend services.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2022-45060 | HTTP request forwarding flaw where Host header manipulation in HTTP/2 to HTTP/1.1 proxying allows request smuggling to backend services. | < 7.2.0 | 7.5 |
CVE-2021-36740 | HTTP/2 request smuggling via method normalization; attacker can inject crafted requests through the proxy layer. | < 6.6.2, < 6.9.0 | 6.5 |
CVE-2020-11653 | Denial of service via HTTP workspace memory exhaustion triggered by specially crafted request sequences. | < 6.2.3 | 7.5 |
CVE-2019-15892 | Heap out-of-bounds read via crafted HTTP/1 request triggering buffer parsing error. | < 6.2.0 | 7.5 |
CVE-2017-8807 | Buffer over-read in HTTP/1 chunked encoding handler; can lead to information disclosure. | < 4.0.5, < 5.0 | 9.1 |
CPE namespace handling
NVD uses two CPE vendor strings for Varnish Cache, reflecting a historical naming change in the project. Attestd queries both and merges on CVE ID. If one namespace returns unexpectedly few records, the alternative should be verified at nvd.nist.gov before concluding coverage is complete.
cpe:2.3:a:varnish-cache:varnishPrimary namespacecpe:2.3:a:varnish_cache_project:varnish_cacheAlternative namespace