CVE-2022-23959 - CVE House
Back to Database
Status published Critical CVE-2022-23959

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish...

Vulnerability Description

In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-23959

Credits & Attribution

No credits recorded in the NVD database.

References

More from varnish-software

View All →
CVE-2025-47905
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish...
Medium 5.4
CVE-2025-30347
Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive...
Medium 4
CVE-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow...
Medium 5.4
CVE-2022-45060
An HTTP Request Forgery issue was discovered in Varnish Cache...
Unknown 0
CVE-2019-15892
An issue was discovered in Varnish Cache before 6.0.4 LTS,...
High 7.5

Affected Vendor

varnish-software

View all reports →

Affected Software

varnich cache, varnish cache, varnish cache plus, fedora, debian linux
Vulnerable Versions:
1.0.0, 4.1.1, 4.1, 6.0.0, 7.0.0, 35, 9.0, 10.0, 11.0

Timeline

Official Publish: January 26th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.