Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-47905

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Published

2025-05-13T22:15:24.990

Last Modified

2025-05-29T09:15:26.587

Status

Awaiting Analysis

Source

[email protected]

Severity

CVSSv3.1: 5.4 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-444
Affected Vendors & Products

-

References