CoreCVE
Back

HIGH

varnish: denial of service handling certain crafted HTTP/1 requests

Published Sep 3, 2019

Description

An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. An HTTP/1 parsing failure allows a remote attacker to trigger an assert by sending crafted HTTP/1 requests. The assert will cause an automatic restart with a clean cache, which makes it a Denial of Service attack.

Affected products

Remediation

Red Hat statement

This is a remote denial of service flaw in varnish cache application. It causes varnish to restart, with a clean cache, since the purpose of varnish is to cache web pages thereby improving overall web server performance, an attacker can cause web performance to degrade due to this attack.

Red Hat mitigation

This flaw can be mitigated by using making changes in varnish configuration by using VCL (Varnish Configuration Language). More details available at: https://varnish-cache.org/security/VSV00003-mitigation.html#vsv00003-mitigation

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-617

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Sep 3, 2019
Updated Aug 5, 2024
Reserved Sep 3, 2019
Link CVE-2019-15892
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2019-15892
Red Hat
Severity Moderate
Public date Sep 3, 2019
Links CVE-2019-15892 - Bugzilla
ENISA EUVD
Assigner mitre
Published Sep 3, 2019
Updated Aug 5, 2024
Exploited since n/a
Link EUVD-2019-6803
EUVD-2019-6803