Arch Linux Security Advisory ASA-202107-28 ========================================== Severity: Medium Date : 2021-07-14 CVE-ID : CVE-2021-36740 Package : varnish Type : url request injection Remote : Yes Link : https://security.archlinux.org/AVG-2154 Summary ======= The package varnish before version 6.6.1-1 is vulnerable to url request injection. Resolution ========== Upgrade to 6.6.1-1. # pacman -Syu "varnish>=6.6.1-1" The problem has been fixed upstream in version 6.6.1. Workaround ========== The issue can be mitigated by turning off support for HTTP/2, using sudo varnishadm param.set feature -http2 or by preventing connection reuse with the following configuration: sub vcl_backend_fetch { set bereq.http.Connection = "close"; } Description =========== Varnish Cache before version 6.6.1, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. Impact ====== A remote attacker could inject arbitrary HTTP requests through an HTTP/2 POST request with a large Content-Length header. References ========== https://varnish-cache.org/security/VSV00007.html https://github.com/varnishcache/varnish-cache/commit/7d73bc843ea9bff79e33773... https://security.archlinux.org/CVE-2021-36740