CVE-2025-47905: Medium severity varnish cache vulnerability
This vulnerability may allow for request smuggling attacks, potentially resulting in an unspecified system caching incorrect content.
The bug is an error in how to parse a chunked message body. The RFC tells to use only CRLF sequence to end a line: https://www.rfc-editor.org/rfc/rfc9112.html#name-chunked-transfer-coding However, Varnish has up until now mistakenly treated white-spaces as line ending as well. This allows a client to construct a HTTP/1 request to smuggle another malicious request in the body of the first request. When this is used against an endpoint that is blindly forwarding HTTP requests, it can lead to ways for this client to abuse this behavior of Varnish.
Other sources
Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47905?
CVE-2025-47905 has a moderate severity rating due to the potential for client-side desynchronization vulnerabilities.
How do I fix CVE-2025-47905?
To fix CVE-2025-47905, upgrade Varnish Cache to version 7.6.3 or later, or Varnish Enterprise to version 6.0.13r14 or later.
What versions of Varnish are affected by CVE-2025-47905?
CVE-2025-47905 affects Varnish Cache versions before 7.6.3 and 7.7 before 7.7.1, as well as Varnish Enterprise versions before 6.0.13r14.
What kind of attacks can CVE-2025-47905 lead to?
CVE-2025-47905 can lead to client-side desynchronization attacks via improperly handled HTTP/1 requests.
Is CVE-2025-47905 a remote vulnerability?
Yes, CVE-2025-47905 can be exploited remotely, requiring only the ability to send HTTP/1 requests to the affected server.