CVE-2022-45059

An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.

The varnish package version as shipped with Red Hat Enterprise Linux 8 and 9 and also with Red Hat Software Collections are not affected by this issue. This vulnerability affects only varnish 7 versions, while the distributed packages are based on Varnish 6.0 LTS releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.