CVE-2019-15892: High severity varnish cache vulnerability
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-15892?
CVE-2019-15892 is a vulnerability in Varnish Cache that allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests, leading to a Denial of Service.
What is the severity of CVE-2019-15892?
The severity of CVE-2019-15892 is high, with a severity score of 7.5.
Which versions of Varnish Cache are affected by CVE-2019-15892?
Varnish Cache versions before 6.0.4 LTS and 6.1.x and 6.2.x before 6.2.1 are affected by CVE-2019-15892.
How can I fix CVE-2019-15892?
To fix CVE-2019-15892, it is recommended to update Varnish Cache to version 6.0.4 LTS or 6.2.1, depending on the affected version.
Where can I find more information about CVE-2019-15892?
More information about CVE-2019-15892 can be found at the following references: [1](https://varnish-cache.org/security/VSV00003.html), [2](https://github.com/varnishcache/varnish-cache/commit/1cb778f6f69737109e8c070a74b8e95b78f46d13), [3](https://github.com/varnishcache/varnish-cache/commit/0f0e51e9871ed1bd1236378f8b0dea0d33df4e9e).