Varnish Cache and Varnish Enterprise Request Smuggling Vulnerability on HTTP/1 Connections

A request smuggling vulnerability has been identified in Varnish Cache versions prior to 6.6.2 and 7.x prior to 7.0.2, as well as in Varnish Cache 6.0 LTS versions prior to 6.0.10. Additionally, Varnish Enterprise (Cache Plus) versions 4.1.x prior to 4.1.11r6 and 6.0.x prior to 6.0.9r4 are affected. This vulnerability allows smuggled requests to be processed as normal requests by the Varnish server, potentially leading to information disclosure and cache poisoning.

Impact

Exploitation of this vulnerability allows for request smuggling on HTTP/1 connections, with the smuggled request being processed as an additional request by the Varnish server. This can disrupt normal operations and potentially lead to information disclosure and cache poisoning.

Remediation

Users can upgrade to Varnish Cache versions 6.6.2, 7.0.2, or 6.0.10, or to Varnish Enterprise versions 4.1.11r6 or 6.0.9r4. After upgrading, Varnish should be restarted. For Debian users, the upgrade can be done using the package manager. Fedora users can also upgrade through the package manager.