CVE-2025-47905

Description

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Reserved 2025-05-13 | Published 2025-05-13 | Updated 2025-05-29 | Assigner mitre

Problem types

CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Product status

Default status
unaffected

Any version before 6.0.14 LTS
affected

7.0.0 before 7.6.3
affected

7.7.0 before 7.7.1
affected

References

varnish-cache.org/security/VSV00016.html

cve.org (CVE-2025-47905)

nvd.nist.gov (CVE-2025-47905)

Download JSON