CVE-2015-8852: debian debian_linux
Vulnerability summary
CVE-2015-8852 is a high (CVSS 7.5) vulnerability in debian debian_linux. EPSS estimates a 3.52% chance of exploitation in the next 30 days, higher than 89% of scored vulnerabilities.
Timeline
- 25-04-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a header line terminated by a \r (carriage return) character in conjunction with multiple Content-Length headers in an HTTP request.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
3.52%
Chance of exploitation in the next 30 days
Percentile
89%
Versus all other CVEs
30-day change
0.00 pp
From 3.52% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- varnish< 4.0.0-1 | < 3.0.2-2+deb7u2
- debian_linuxEOL7.0
Mageia1 product
- varnish< 3.0.3-19.1.mga5
Ubuntu1 product
- varnish< 3.0.5-2ubuntu0.1
Varnish_cache_project1 product
- varnish_cache3.0.0:beta1 | 3.0.0:beta2 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6
4 vendors · 5 products
References
14 links
- www.varnish-cache.org/lists/pipermail/varnish-announce/2015-March/000701.htmlMailing ListX Refsource MLISTVendor Advisory