Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8550 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:8337 advisory.

    * varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8336 advisory.

    varnish     [6.0.13-1.1]
    - Resolves: RHEL-89695 - varnish: request smuggling attacks (CVE-2025-47905)

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8337 advisory.

    [6.6.2-6.1]
    - Resolves: RHEL-89700 - varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8351 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8350 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8339 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8337 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8336 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8340 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8349 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4187 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4187-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     May 28, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : varnish     Version        : 6.5.1-1+deb11u5     CVE ID         : CVE-2025-47905

    A client-side desync vulnerability can be triggered in Varnish, a     high-performance web accelerator. An attacker can abuse a flaw in Varnishs     handling of chunked transfer encoding which allows certain malformed HTTP/1     requests to exploit improper framing of the message body to smuggle additional     requests. Specifically, Varnish incorrectly permits CRLF to be skipped to     delimit chunk boundaries.

    For Debian 11 bullseye, this problem has been fixed in version     6.5.1-1+deb11u5.

    We recommend that you upgrade your varnish packages.

    For the detailed security status of varnish please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/varnish

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8310 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8294 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
237844	RHEL 10 : varnish (RHSA-2025:8550)	Nessus	Red Hat Local Security Checks	medium
237657	AlmaLinux 9 : varnish (ALSA-2025:8337)	Nessus	Alma Linux Local Security Checks	medium
237656	Oracle Linux 8 : varnish:6 (ELSA-2025-8336)	Nessus	Oracle Linux Local Security Checks	medium
237655	Oracle Linux 9 : varnish (ELSA-2025-8337)	Nessus	Oracle Linux Local Security Checks	medium
237651	RHEL 9 : varnish (RHSA-2025:8351)	Nessus	Red Hat Local Security Checks	medium
237650	RHEL 9 : varnish (RHSA-2025:8350)	Nessus	Red Hat Local Security Checks	medium
237643	RHEL 8 : varnish:6 (RHSA-2025:8339)	Nessus	Red Hat Local Security Checks	medium
237642	RHEL 9 : varnish (RHSA-2025:8337)	Nessus	Red Hat Local Security Checks	medium
237641	RHEL 8 : varnish:6 (RHSA-2025:8336)	Nessus	Red Hat Local Security Checks	medium
237639	RHEL 8 : varnish:6 (RHSA-2025:8340)	Nessus	Red Hat Local Security Checks	medium
237633	RHEL 9 : varnish (RHSA-2025:8349)	Nessus	Red Hat Local Security Checks	medium
237462	Debian dla-4187 : libvarnishapi-dev - security update	Nessus	Debian Local Security Checks	medium
237457	RHEL 8 : varnish:6 (RHSA-2025:8310)	Nessus	Red Hat Local Security Checks	medium
237455	RHEL 8 : varnish:6 (RHSA-2025:8294)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2025-47905

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium