CVE-2021-36740

A flaw was found in Varnish. The Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. As a result, this flaw allows the information on the Varnish cache to be poisoned. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue can be mitigated by:

1. Disabling HTTP/2 request support by executing:

sudo varnishadm param.set feature -http2

2. Disabling backend connection reuse on varnish side, the following rule can be inserted into Varnish configuration:

sub vcl_backend_fetch {
      set bereq.http.Connection = "close";
}