Client-Side Desync Vulnerability in Varnish Cache
Summary
ALPINE-CVE-2025-47905: Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundari... Affects varnish versions < 7.6.3-r0. Fixed in 7.6.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Varnish Cache is a powerful HTTP accelerator designed for high-performance web applications. It is widely used to improve the speed and efficiency of web servers by caching content and reducing server load. However, certain versions of Varnish Cache are susceptible to a vulnerability that allows client-side desynchronization through improper handling of HTTP/1 requests.
Vulnerability Detail
The vulnerability, identified as CVE-2025-47905, affects Varnish Cache versions prior to 7.6.3 and 7.7 before 7.7.1. It arises from the product's failure to correctly manage CRLF (Carriage Return Line Feed) sequences, which can be exploited to manipulate chunk boundaries in HTTP/1 requests. This can lead to unexpected behavior, including potential data leakage or denial of service, as the server may misinterpret the structure of incoming requests.
How To Fix
Minimum fixed version
7.6.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade varnishTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement strict input validation on your HTTP requests to mitigate the risk of desynchronization until you can apply the patch. Ensure that your application properly handles CRLF sequences and rejects malformed requests.
Conclusion
The CVE-2025-47905 vulnerability in Varnish Cache poses significant risks to web applications by allowing client-side desynchronization. It is crucial to update to the latest patched versions to safeguard your application against potential exploitation.
See every vulnerability recorded for varnish →
FAQ
CVE-2025-47905 is a vulnerability in Varnish Cache that allows client-side desynchronization due to improper handling of HTTP/1 requests.
Versions of Varnish Cache prior to 7.6.3 and 7.7 before 7.7.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to data leakage, denial of service, or other unexpected behaviors in your web application.
Implement strict input validation on HTTP requests to reject malformed requests and reduce the risk of desynchronization.
References
Related vulnerabilities
Recent vulnerabilities recorded for varnish.
