CVE-2022-23959: debian debian_linux HTTP Request/Response Smuggling
CVSS: 9.1v3.1CriticalModified
AliasesALPINE-CVE-2022-23959MGASA-2022-0079RHSA-2022:0418RHSA-2022:0420RHSA-2022:0421RHSA-2022:0422RHSA-2022:4745UBUNTU-CVE-2022-23959DEBIAN-CVE-2022-23959DLA-2920-1openSUSE-SU-2024:12086-1
Published 26-01-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-23959 is a critical (CVSS 9.1) HTTP Request/Response Smuggling vulnerability in debian debian_linux. EPSS estimates a 2.01% chance of exploitation in the next 30 days, higher than 80.6% of scored vulnerabilities.
CVSS score
9.1/10
010
Critical · v3.1 (NVD)EPSS score
2.01%
0%100%
Low · +0.04 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 26-01-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
CVSS metrics
6 scores · 5 sources · 2 versionsCritical 9.1Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Medium 6.4Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
2.01%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
+0.04 pp
From 1.97% on 21-09-2026
21-09-202621-10-2026
EPSS score2.01%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat10 products
- rh-varnish6-varnish< 0:6.0.8-2.el7.1
- rh-varnish6-varnish-devel< 0:6.0.8-2.el7.1
- rh-varnish6-varnish-docs< 0:6.0.8-2.el7.1
- rh-varnish6-varnish-libs< 0:6.0.8-2.el7.1
- varnish< 0:6.0.8-1.module+el8.5.0+14089+03a0c2cc.1 | < 0:6.0.2-2.module+el8.1.0+14093+aa8ea65f.1 | < 0:6.0.2-2.module+el8.2.0+14091+b587eafb.1 | < 0:6.0.6-2.module+el8.4.0+14090+331e4860.2
Varnish-software3 products
- varnich_cache≥ 1.0.0, < 6.6.2 | ≥ 4.1.1, < 4.1.11r6 | 4.1
- varnish_cache≥ 6.0.0, < 6.0.10
- varnish_cache_plus≥ 6.0.0, < 6.0.9r4
Debian2 products
- varnish< 5.0.0-7+deb9u3 | < 7.1.0-5
- debian_linuxEOL9.0 | 10.0 | 11.0
Alpine1 product
- varnish< 6.5.2-r1 | < 6.6.2-r0 | < 7.0.2-r0
Fedoraproject1 product
- fedoraEOL35
Mageia1 product
- varnish< 6.5.1-1.2.mga8
Opensuse1 product
- varnish&distro=openSUSE Tumbleweed< 7.1.0-1.1
Ubuntu1 product
- varnishAll versions (No fix recorded) | < 5.2.1-1ubuntu0.1 | < 6.2.1-2ubuntu0.1 | < 6.6.1-1ubuntu0.2
Varnish_cache_project1 product
- varnish_cache≥ 7.0.0, < 7.0.2
9 vendors · 21 products
References
30 links
lists.debian.org/debian-lts-announce/2022/02/msg00014.htmlMailing ListX Refsource MLISTThird Party Advisory
