CVE-2021-28543
varnish-modules: NULL pointer dereference in Varnish Cache via header.append() and header.copy() functions
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · March 16, 2021
Updated · November 22, 2025
Description
A NULL pointer dereference issue was found in Varnish Cache through the 'header' module from the separate varnish-modules package. This flaw might allow for remote clients to cause Varnish to assert and restart, reducing overall availability and performance due to an increased number of cache misses, and may cause higher load on back-end servers. There is no potential for remote code execution or data leaks related to this vulnerability.
Statement
The following products are not affected by this flaw, as they ship an older version of the varnish-modules package which did not include the vulnerable code in the header vmod:
- Red Hat Enterprise Linux 8
- Red Hat Software Collections
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
Refer to https://varnish-cache.org/security/VSV00006.html#mitigation.
CVSS / CWE
CVSS 3.1 · 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference