CVE-2025-47905 - Vulnerability Details

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux Rhel Aus Rhel E4s Rhel Eus Rhel Tus

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 10
varnish-0:7.6.1-2.el10_0.1	cpe:/o:redhat:enterprise_linux:10.0	RHSA-2025:8550	2025-06-04T00:00:00Z
Red Hat Enterprise Linux 8
varnish:6-8100020250521162715.489197e6	cpe:/a:redhat:enterprise_linux:8	RHSA-2025:8336	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 8.2 Advanced Update Support
varnish:6-8020020250522134231.4cda2c84	cpe:/a:redhat:rhel_aus:8.2	RHSA-2025:8339	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
varnish:6-8040020250522134003.522a0ee4	cpe:/a:redhat:rhel_aus:8.4	RHSA-2025:8340	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
varnish:6-8040020250522134003.522a0ee4	cpe:/a:redhat:rhel_tus:8.4	RHSA-2025:8340	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
varnish:6-8040020250522134003.522a0ee4	cpe:/a:redhat:rhel_e4s:8.4	RHSA-2025:8340	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
varnish:6-8060020250522133304.ad008a3a	cpe:/a:redhat:rhel_aus:8.6	RHSA-2025:8310	2025-05-29T00:00:00Z
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
varnish:6-8060020250522133304.ad008a3a	cpe:/a:redhat:rhel_tus:8.6	RHSA-2025:8310	2025-05-29T00:00:00Z
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
varnish:6-8060020250522133304.ad008a3a	cpe:/a:redhat:rhel_e4s:8.6	RHSA-2025:8310	2025-05-29T00:00:00Z
Red Hat Enterprise Linux 8.8 Extended Update Support
varnish:6-8080020250522125234.63b34585	cpe:/a:redhat:rhel_eus:8.8	RHSA-2025:8294	2025-05-29T00:00:00Z
Red Hat Enterprise Linux 9
varnish-0:6.6.2-6.el9_6.1	cpe:/a:redhat:enterprise_linux:9	RHSA-2025:8337	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
varnish-0:6.6.2-2.el9_0.4	cpe:/a:redhat:rhel_e4s:9.0	RHSA-2025:8350	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 9.2 Extended Update Support
varnish-0:6.6.2-3.el9_2.3	cpe:/a:redhat:rhel_eus:9.2	RHSA-2025:8351	2025-06-02T00:00:00Z
Red Hat Enterprise Linux 9.4 Extended Update Support
varnish-0:6.6.2-5.el9_4.1	cpe:/a:redhat:rhel_eus:9.4	RHSA-2025:8349	2025-06-02T00:00:00Z

References

Link	Providers
http://www.openwall.com/lists/oss-security/2025/05/15/2
https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html
https://nvd.nist.gov/vuln/detail/CVE-2025-47905
https://varnish-cache.org/security/VSV00016.html
https://www.cve.org/CVERecord?id=CVE-2025-47905

History

Fri, 06 Jun 2025 22:00:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:/o:redhat:enterprise_linux:10.0

Tue, 03 Jun 2025 06:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:rhel_aus:8.2 cpe:/a:redhat:rhel_aus:8.4 cpe:/a:redhat:rhel_e4s:8.4 cpe:/a:redhat:rhel_e4s:9.0 cpe:/a:redhat:rhel_eus:9.2 cpe:/a:redhat:rhel_eus:9.4 cpe:/a:redhat:rhel_tus:8.4
Vendors & Products		Redhat enterprise Linux

Sat, 31 May 2025 00:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Aus Redhat rhel E4s Redhat rhel Tus
CPEs		cpe:/a:redhat:rhel_aus:8.6 cpe:/a:redhat:rhel_e4s:8.6 cpe:/a:redhat:rhel_tus:8.6
Vendors & Products		Redhat rhel Aus Redhat rhel E4s Redhat rhel Tus

Thu, 29 May 2025 19:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat rhel Eus
CPEs		cpe:/a:redhat:rhel_eus:8.8
Vendors & Products		Redhat Redhat rhel Eus

Thu, 29 May 2025 09:30:00 +0000

Type	Values Removed	Values Added
References		https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html

Tue, 20 May 2025 02:30:00 +0000

Type	Values Removed	Values Added
Title		varnish: request smuggling attacks
References		https://nvd.nist.gov/vuln/detail/CVE-2025-47905 https://www.cve.org/CVERecord?id=CVE-2025-47905
Metrics	threat_severity `None`	threat_severity `Important`

Thu, 15 May 2025 19:45:00 +0000

Type	Values Removed	Values Added
References		http://www.openwall.com/lists/oss-security/2025/05/15/2

Wed, 14 May 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 13 May 2025 22:15:00 +0000

Type	Values Removed	Values Added
Description		Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
Weaknesses		CWE-444
References		https://varnish-cache.org/security/VSV00016.html
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-05-13T00:00:00.000Z

Updated: 2025-05-29T09:03:18.582Z

Reserved: 2025-05-13T00:00:00.000Z

Link: CVE-2025-47905

Vulnrichment

Updated: 2025-05-29T09:03:18.582Z

NVD

Status : Awaiting Analysis

Published: 2025-05-13T22:15:24.990

Modified: 2025-05-29T09:15:26.587

Link: CVE-2025-47905

Redhat

Severity : Important

Publid Date: 2025-05-13T00:00:00Z

Links: CVE-2025-47905 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-47905", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-05-29T09:03:18.582Z", "dateReserved": "2025-05-13T00:00:00.000Z", "datePublished": "2025-05-13T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Varnish Cache", "vendor": "varnish-software", "versions": [{"lessThan": "6.0.14 LTS", "status": "affected", "version": "0", "versionType": "custom"}, {"lessThan": "7.6.3", "status": "affected", "version": "7.0.0", "versionType": "custom"}, {"lessThan": "7.7.1", "status": "affected", "version": "7.7.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-05-13T22:02:08.051Z"}, "references": [{"url": "https://varnish-cache.org/security/VSV00016.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.0.14 LTS"}, {"vulnerable": true, "criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.0", "versionEndExcluding": "7.6.3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.7.0", "versionEndExcluding": "7.7.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-14T14:15:16.258197Z", "id": "CVE-2025-47905", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-14T14:15:21.703Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/05/15/2"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-05-29T09:03:18.582Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2025/05/15/2"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-05-29T09:03:18.582Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-47905", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-14T14:15:16.258197Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-14T14:15:18.689Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "varnish-software", "product": "Varnish Cache", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.14 LTS", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "lessThan": "7.6.3", "versionType": "custom"}, {"status": "affected", "version": "7.7.0", "lessThan": "7.7.1", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://varnish-cache.org/security/VSV00016.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.0.14 LTS"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.6.3", "versionStartIncluding": "7.0.0"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.7.1", "versionStartIncluding": "7.7.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-05-13T22:02:08.051Z"}}}, "cveMetadata": {"cveId": "CVE-2025-47905", "state": "PUBLISHED", "dateUpdated": "2025-05-29T09:03:18.582Z", "dateReserved": "2025-05-13T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-05-13T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries."}, {"lang": "es", "value": "Varnish Cache anterior a 7.6.3 y 7.7 anterior a 7.7.1, y Varnish Enterprise anterior a 6.0.13r14, permiten la desincronizaci\u00f3n del lado del cliente a trav\u00e9s de solicitudes HTTP/1, porque el producto permite incorrectamente que se omita CRLF para delimitar los l\u00edmites de los fragmentos."}], "id": "CVE-2025-47905", "lastModified": "2025-05-29T09:15:26.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}]}, "published": "2025-05-13T22:15:24.990", "references": [{"source": "cve@mitre.org", "url": "https://varnish-cache.org/security/VSV00016.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2025/05/15/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2025:8550", "cpe": "cpe:/o:redhat:enterprise_linux:10.0", "package": "varnish-0:7.6.1-2.el10_0.1", "product_name": "Red Hat Enterprise Linux 10", "release_date": "2025-06-04T00:00:00Z"}, {"advisory": "RHSA-2025:8336", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "varnish:6-8100020250521162715.489197e6", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8339", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "varnish:6-8020020250522134231.4cda2c84", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8340", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "varnish:6-8040020250522134003.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8340", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "varnish:6-8040020250522134003.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8340", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "varnish:6-8040020250522134003.522a0ee4", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8310", "cpe": "cpe:/a:redhat:rhel_aus:8.6", "package": "varnish:6-8060020250522133304.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "release_date": "2025-05-29T00:00:00Z"}, {"advisory": "RHSA-2025:8310", "cpe": "cpe:/a:redhat:rhel_tus:8.6", "package": "varnish:6-8060020250522133304.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "release_date": "2025-05-29T00:00:00Z"}, {"advisory": "RHSA-2025:8310", "cpe": "cpe:/a:redhat:rhel_e4s:8.6", "package": "varnish:6-8060020250522133304.ad008a3a", "product_name": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "release_date": "2025-05-29T00:00:00Z"}, {"advisory": "RHSA-2025:8294", "cpe": "cpe:/a:redhat:rhel_eus:8.8", "package": "varnish:6-8080020250522125234.63b34585", "product_name": "Red Hat Enterprise Linux 8.8 Extended Update Support", "release_date": "2025-05-29T00:00:00Z"}, {"advisory": "RHSA-2025:8337", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "varnish-0:6.6.2-6.el9_6.1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8350", "cpe": "cpe:/a:redhat:rhel_e4s:9.0", "package": "varnish-0:6.6.2-2.el9_0.4", "product_name": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8351", "cpe": "cpe:/a:redhat:rhel_eus:9.2", "package": "varnish-0:6.6.2-3.el9_2.3", "product_name": "Red Hat Enterprise Linux 9.2 Extended Update Support", "release_date": "2025-06-02T00:00:00Z"}, {"advisory": "RHSA-2025:8349", "cpe": "cpe:/a:redhat:rhel_eus:9.4", "package": "varnish-0:6.6.2-5.el9_4.1", "product_name": "Red Hat Enterprise Linux 9.4 Extended Update Support", "release_date": "2025-06-02T00:00:00Z"}], "bugzilla": {"description": "varnish: request smuggling attacks", "id": "2364235", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2364235"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.1", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "status": "verified"}, "cwe": "CWE-444", "details": ["Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.", "A vulnerability was found in Varnish Cache. This vulnerability may allow request smuggling attacks, where a malicious actor can craft seemingly legitimate HTTP requests. This issue could result in an unspecified system caching incorrect content that can expose confidential information."], "mitigation": {"lang": "en:us", "value": "Currently, no mitigation is available for this vulnerability."}, "name": "CVE-2025-47905", "public_date": "2025-05-13T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-47905\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-47905"], "statement": "This vulnerability is rated as an IMPORTANT severity because this is a client-side desync vulnerability in Varnish handling a chunked transfer encoding, where it mishandles CRLF delimiters, allows attackers to smuggle additional HTTP/1 requests, this flaw allows attacker to unauthorized access of sensitive information and data alteration.", "threat_severity": "Important"}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object