Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral MSE4 stevedore objects.

This vulnerability may allow for request smuggling attacks, potentially resulting in an unspecified system caching incorrect content.

The bug is an error in how to parse a chunked message body. The RFC tells to use only CRLF sequence to end a line: https://www.rfc-editor.org/rfc/rfc9112.html#name-chunked-transfer-coding However, Varnish has up until now mistakenly treated white-spaces as line ending as well. This allows a client to construct a HTTP/1 request to smuggle another malicious request in the body of the first request. When this is used against an endpoint that is blindly forwarding HTTP requests, it can lead to ways for this client to abuse this behavior of Varnish.

This vulnerability may allow for request smuggling attacks, potentially resulting in an unspecified system caching incorrect content.

The bug is an error in how to parse a chunked message body. The RFC tells to use only CRLF sequence to end a line: https://www.rfc-editor.org/rfc/rfc9112.html#name-chunked-transfer-coding However, Varnish has up until now mistakenly treated white-spaces as line ending as well. This allows a client to construct a HTTP/1 request to smuggle another malicious request in the body of the first request. When this is used against an endpoint that is blindly forwarding HTTP requests, it can lead to ways for this client to abuse this behavior of Varnish.

Hello again,

On Tue, May 13, 2025 at 4:57 PM Asad Ahmed <asadsa () varnish-software com> wrote: CVE: Not assigned yet, expect a follow-up here. CVE-2025-47905 <https://www.cve.org/CVERecord?id=CVE-2025-47905>

References: - https://varnish-cache.org/security/VSV00016.html#vsv00016 - https://varnish-cache.org/security/index.html - https://varnish-cache.org/lists/pipermail/varnish-announce/2025-May/000767.html - https://github.com/varnishcache/varnish-cache - https://varnish-cache.org/releases/rel7.7.1.html#rel7-7-1 - https://varnish-cache.org/releases/rel7.6.3.html#rel7-6-3 - https://varnish-cache.org/releases/rel6.0.14.html#rel6-0-14 A follow-up announcement to share an update to the release notes: - https://varnish-cache.org/lists/pipermail/varnish-announce/2025-May/000768.html

-- Asad