CVE-2019-20637
varnish: not clearing pointer between two client requests leads to information disclosure
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 21, 2019
Updated · November 22, 2025
Description
An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 3.1CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor