Varnish-software Varnish_enterprise
6 CVEs affecting Varnish-software Varnish_enterprise. Latest disclosed: 2026-04-12. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41104 | Medium | 6.5 | 2023-08-23 | libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both au… |
CVE-2026-34475 | Medium | 5.4 | 2026-03-27 | Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, poten… |
CVE-2025-30346 | Medium | 5.4 | 2025-03-21 | Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. |
CVE-2026-40395 | Medium | 4.0 | 2026-04-12 | Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vm… |
CVE-2026-40394 | Medium | 4.0 | 2026-04-12 | Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of pref… |
CVE-2025-30347 | Medium | 4.0 | 2025-03-21 | Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stev… |