CVE-2022-45060

highpriority · track · 30EPSS 0.010 · 64 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.04% (64th) EPSS

CVSS 7.5 · high

Is it mine?

49 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 3.6

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondaryexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-918US

affected products (49)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Gentoo Linuxall versionscert_bundDEcpe:/o:gentoo:linux:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Open Source Varnish HTTP Cache< 6.0.11cert_bundDE
Open Source Varnish HTTP Cache< 7.1.2cert_bundDE
Open Source Varnish HTTP Cache< 7.2.1cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.2 Advanced Update Supportfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 9.0 Extended Update Supportfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.6 Extended Update Supportfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.2 Update Services for SAP Solutionsfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.2 Telecommunications Update Servicefstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 9fstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.4 Extended Update Supportfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8.1 Update Services for SAP Solutionsfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
Varnish Software Varnish≤ 7.2.1fstec_bduRU
Varnish Software Varnish≤ 6.0.11fstec_bduRU

showing 20 of 49

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2022-2036Varnish HTTP Cache: Mehrere Schwachstellen ermöglichen Manipulation von DateienDeutsch2022-11-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Varnish HTTP Cache ausnutzen, um Dateien zu manipulieren.
BIT-varnish-2022-450602024-03-06vendor · osvUS
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could, in turn, be used to exploit vulnerabilities in a server behind the Varnish server. Note: the 6.0.x LTS series (before 6.0.11) is affected.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2022-11-09modified 2026-06-17

references (30)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan