7.5

CVE-2024-30156: varnish

CVSS: 7.5v3.1HighDeferred
AliasesALPINE-CVE-2024-30156MGASA-2024-0124RHSA-2024:1689
Published 24-03-2024Last modified 21-11-2024
Open JSON

Vulnerability summary

CVE-2024-30156 is a high (CVSS 7.5) vulnerability in varnish. EPSS estimates a 3.66% chance of exploitation in the next 30 days, higher than 89.5% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
3.66%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 24-03-2024
    PublishedVulnerability first disclosed.
  2. 21-11-2024
    Last modifiedVulnerability information updated.

Description

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

3.66%

Chance of exploitation in the next 30 days

Percentile

90%

Versus all other CVEs

30-day change

0.00 pp

From 3.66% on 20-09-2026

20-09-202620-10-2026
EPSS score
3.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat12 products
  • rh-varnish6-varnish< 0:6.0.13-1.el7
  • rh-varnish6-varnish-devel< 0:6.0.13-1.el7
  • rh-varnish6-varnish-docs< 0:6.0.13-1.el7
  • rh-varnish6-varnish-libs< 0:6.0.13-1.el7
  • rh-varnish6-varnish-modules< 0:0.15.0-8.el7
Alpine1 product
  • varnish< 7.3.2-r0 | < 7.4.3-r0 | < 7.5.0-r0
Debian1 product
  • varnishAll versions (No fix recorded) | < 7.5.0-1
Mageia1 product
  • varnish< 7.3.2-1.mga9
Ubuntu1 product
  • varnishAll versions (No fix recorded)

5 vendors · 16 products

References

31 links
Show all 31 references