Known Vulnerabilities for Varnish by Varnish-cache
Listed below are 7 of the newest known vulnerabilities associated with "Varnish" by "Varnish-cache".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-34475 | Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs wi... | Not Provided | 2026-03-27 | 2026-03-27 |
| CVE-2025-62867 | Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured A... | Not Provided | 2025-12-09 | 2026-04-01 |
| CVE-2025-62126 | Insertion of Sensitive Information Into Sent Data vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows ... | Not Provided | 2025-12-31 | 2026-04-01 |
| CVE-2025-58807 | Cross-Site Request Forgery (CSRF) vulnerability in Dsingh Purge Varnish Cache purge-varnish allows Stored XSS.This issue affe... | Not Provided | 2025-09-05 | 2026-04-01 |
| CVE-2025-48360 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/N... | Not Provided | 2025-08-28 | 2026-04-01 |
| CVE-2025-31616 | Cross-Site Request Forgery (CSRF) vulnerability in AdminGeekZ Varnish WordPress varnish-wp allows Cross Site Request Forgery.... | Not Provided | 2025-03-31 | 2026-04-01 |
| CVE-2019-15892 | An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows... | 7.5 - HIGH | 2019-09-03 | 2023-11-07 |
| CVE-2017-12425 | An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wro... | 7.5 - HIGH | 2017-08-04 | 2022-08-02 |
| CVE-2017-8807 | vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows remote... | 9.1 - CRITICAL | 2017-11-16 | 2022-08-02 |
| CVE-2015-8852 | Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP header... | 7.5 - HIGH | 2016-04-25 | 2022-08-02 |
Known Affected Configurations (CPE V2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Varnish-cache | Varnish | 6.2.1 | All | All | All |
| Application | Varnish-cache | Varnish | 6.2.0 | All | All | All |
| Application | Varnish-cache | Varnish | 6.1.1 | All | All | All |
| Application | Varnish-cache | Varnish | 6.1.0 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.4 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.4 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.3 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.3 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.2 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.2 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.1 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.0 | All | All | All |
| Application | Varnish-cache | Varnish | 6.0.0 | All | All | All |
| Application | Varnish-cache | Varnish | 5.2.1 | All | All | All |
| Application | Varnish-cache | Varnish | 5.2.0 | - | All | All |
| Application | Varnish-cache | Varnish | 5.2.0 | rc1 | All | All |
| Application | Varnish-cache | Varnish | 5.2.0 | rc2 | All | All |
| Application | Varnish-cache | Varnish | 5.1.3 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.2 | All | All | All |
| Application | Varnish-cache | Varnish | 5.1.1 | All | All | All |