CVE-2021-36740

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request

published July 14, 2021

CVSS
—
EPSS
2%
Percentile
75.6
In the wild
Unconfirmed
What it is

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01599 · 75.6th percentile
Published
2021-07-14T16:07Z
EPSS history
Timeline
  • 14 JUL 16:07Z
    Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request
    cvelistv5