Denial of Service Vulnerability in Varnish Cache: CVE-2019-15892
Summary
ALPINE-CVE-2019-15892: An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. Affects varnish versions < 6.2.1-r0. Fixed in 6.2.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Varnish Cache is a powerful web application accelerator designed for content-heavy dynamic websites. It acts as a reverse proxy, caching content to improve load times and reduce server load. Varnish is widely used for its high performance and flexibility, allowing users to configure caching rules and optimize content delivery. However, it has been found to be vulnerable to an HTTP/1 parsing failure, which can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
An issue was discovered in Varnish Cache before version 6.0.4 LTS, and in versions 6.1.x and 6.2.x before 6.2.1. The vulnerability arises from a failure to properly parse HTTP/1 requests, allowing a remote attacker to send crafted requests that trigger an assert. This assert leads to an automatic restart of the Varnish service, clearing the cache and resulting in a Denial of Service condition. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
6.2.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade varnishTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement network-level protections such as rate limiting or IP whitelisting to mitigate the risk of exploitation until the package can be updated.
Conclusion
CVE-2019-15892 represents a significant vulnerability in Varnish Cache that can lead to Denial of Service attacks through crafted HTTP/1 requests. It is crucial for users to update to the patched version to safeguard their applications and maintain service availability.
See every vulnerability recorded for varnish →
FAQ
CVE-2019-15892 is a vulnerability in Varnish Cache that allows remote attackers to trigger a Denial of Service by sending crafted HTTP/1 requests.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to service interruptions, as the Varnish service will restart and clear its cache, affecting content delivery.
Yes, a patch is available in version 6.2.1-r0 and later for Alpine versions 3.10 to 3.22.
The CVSS score for CVE-2019-15892 is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
