The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0273 advisory.

    This advisory aggregates security fixes for the varnish SRPM in CIQ LTS 8.6. It addresses 9 CVEs:
    CVE-2019-20637, CVE-2022-45060, CVE-2023-44487, CVE-2017-8807, CVE-2013-4484, and 4 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0502 advisory.

    This advisory aggregates security fixes for the varnish SRPM in CIQ LTS 9.2. It addresses 8 CVEs:
    CVE-2022-45060, CVE-2023-44487, CVE-2024-30156, CVE-2017-8807, CVE-2013-4484, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Upgrade to new upstream release 2.1.0. This upgrade is important because - The previous 2.0 series will be discontinued within the lifetime of F-13 - 2.1.0 contains a fix for CVE-2009-2936. It is not probably that upstream will backport this fix for the 2.0 series These changes should be important enough to include varnish-2.1.x in F-13, even after the freeze.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
355168	Rocky Linux 8.6 [CIQ] Security Update: varnish / varnish-devel / varnish-docs Multiple Vulnerabilities (ciqsa-2026_0273)	Nessus	Rocky Linux Local Security Checks	Local	medium
354216	Rocky Linux 9.2 [CIQ] Security Update: varnish / varnish-devel / varnish-docs Multiple Vulnerabilities (ciqsa-2026_0502)	Nessus	Rocky Linux Local Security Checks	Local	medium
47446	Fedora 13 : varnish-2.1.0-2.fc13 (2010-6719)	Nessus	Fedora Local Security Checks	Local	high

Detections

Analytics

CVE-2009-2936

high

Tenable Plugins

medium

medium

high