Vulnerability · Published May 13, 2025 · Assigned by mitre
CVE-2025-47905
Medium 5.4
In plain English
A medium-severity security flaw in Varnish Cache from varnish-software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 69.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | varnish | 7.6.1-2.el10_0.1 | ALSA-2025:8550 |
| AlmaLinux:8 | varnish | 6.0.13-1.module_el8.10.0+4003+9759c3c1.1 | ALSA-2025:8336 |
| AlmaLinux:9 | varnish | 6.6.2-6.el9_6.1 | ALSA-2025:8337 |
| AlmaLinux:10 | varnish-devel | 7.6.1-2.el10_0.1 | ALSA-2025:8550 |
| AlmaLinux:8 | varnish-devel | 6.0.13-1.module_el8.10.0+4003+9759c3c1.1 | ALSA-2025:8336 |
| AlmaLinux:9 | varnish-devel | 6.6.2-6.el9_6.1 | ALSA-2025:8337 |
| AlmaLinux:10 | varnish-docs | 7.6.1-2.el10_0.1 | ALSA-2025:8550 |
| AlmaLinux:8 | varnish-docs | 6.0.13-1.module_el8.10.0+4003+9759c3c1.1 | ALSA-2025:8336 |
| AlmaLinux:9 | varnish-docs | 6.6.2-6.el9_6.1 | ALSA-2025:8337 |
| AlmaLinux:8 | varnish-modules | 0.15.0-6.module_el8.9.0+3826+307eaba4 | ALSA-2025:8336 |
| Alpine:v3.21 | varnish | 7.6.3-r0 | ALPINE-CVE-2025-47905 |
| Alpine:v3.22 | varnish | 7.7.1-r0 | ALPINE-CVE-2025-47905 |
| Alpine:v3.23 | varnish | 7.7.1-r0 | ALPINE-CVE-2025-47905 |
| Alpine:v3.24 | varnish | 7.7.1-r0 | ALPINE-CVE-2025-47905 |
| Debian:12 | varnish | 7.1.1-2+deb12u1 | DSA-5918-1 |
| Debian:12 | varnish | 7.1.1-2+deb12u1 | DEBIAN-CVE-2025-47905 |
| Debian:13 | varnish | 7.7.0-2 | DEBIAN-CVE-2025-47905 |
| Rocky Linux:10 | varnish | 0:7.6.1-2.el10_0.1 | RLSA-2025:8550 |
| Rocky Linux:8 | varnish | 0:6.0.13-1.module+el8.9.0+1777+0acf9965 | RLSA-2025:8336 |
| Rocky Linux:8 | varnish | 0:6.0.13-1.module+el8.10.0+1982+334a201b.1 | RLSA-2025:8336 |
| Rocky Linux:9 | varnish | 0:6.6.2-6.el9_6.1 | RLSA-2025:8337 |
| Rocky Linux:8 | varnish-modules | 0:0.15.0-6.module+el8.5.0+677+2a78a869 | RLSA-2025:8336 |
| Ubuntu:24.04:LTS | varnish | no fix listed | UBUNTU-CVE-2025-47905 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| varnish-software | Varnish Cache | 0 – before 6.0.14 LTS7.0.0 – before 7.6.37.7.0 – before 7.7.1 |
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N