The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8337 advisory.

    [6.6.2-6.1]
    - Resolves: RHEL-89700 - varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8550 advisory.

    [7.6.1-2.el10_0.1]
    - Resolves: RHEL-89691 - varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-f7e5d2e40f advisory.

    Security: This update includes fixes for CVE-2025-47905 aka VSV00016: A client-side desync vulnerability     can be triggered in Varnish Cache. This vulnerability can be triggered under specific circumstances     involving malformed HTTP/1 chunked requests.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_8337 advisory.

    * varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8294 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8310 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8339 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8350 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-8336 advisory.

    varnish     [6.0.13-1.1]
    - Resolves: RHEL-89695 - varnish: request smuggling attacks (CVE-2025-47905)

    varnish-modules

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2025_8336 advisory.

    * varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9999:01 advisory.

    * varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763374645 advisory.

  - Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before     6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window     Attack. (CVE-2024-30156)

  - Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-     side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit     chunk boundaries. (CVE-2025-47905)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4187 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4187-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     May 28, 2025                                  https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : varnish     Version        : 6.5.1-1+deb11u5     CVE ID         : CVE-2025-47905

    A client-side desync vulnerability can be triggered in Varnish, a     high-performance web accelerator. An attacker can abuse a flaw in Varnishs     handling of chunked transfer encoding which allows certain malformed HTTP/1     requests to exploit improper framing of the message body to smuggle additional     requests. Specifically, Varnish incorrectly permits CRLF to be skipped to     delimit chunk boundaries.

    For Debian 11 bullseye, this problem has been fixed in version     6.5.1-1+deb11u5.

    We recommend that you upgrade your varnish packages.

    For the detailed security status of varnish please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/varnish

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8349 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:8337 advisory.

    Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't     have to create the same web page over and over again, giving the website a significant speed up.

    Security Fix(es):

    * varnish: request smuggling attacks (CVE-2025-47905)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:8550 advisory.

    * varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:8337 advisory.

    * varnish: request smuggling attacks (CVE-2025-47905)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
237655	Oracle Linux 9 : varnish (ELSA-2025-8337)	Nessus	Oracle Linux Local Security Checks	2025/6/2	2025/9/11	medium
240855	Oracle Linux 10 : varnish (ELSA-2025-8550)	Nessus	Oracle Linux Local Security Checks	2025/6/27	2025/6/27	medium
246915	Fedora 41 : varnish (2025-f7e5d2e40f)	Nessus	Fedora Local Security Checks	2025/8/9	2025/8/9	medium
355024	Rocky Linux 9 [CIQ] Security Update: varnish / varnish-devel / varnish-docs (crlsa-2025_8337)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/5	medium
237455	RHEL 8 : varnish:6 (RHSA-2025:8294)	Nessus	Red Hat Local Security Checks	2025/5/29	2025/10/9	medium
237457	RHEL 8 : varnish:6 (RHSA-2025:8310)	Nessus	Red Hat Local Security Checks	2025/5/29	2025/10/9	medium
237643	RHEL 8 : varnish:6 (RHSA-2025:8339)	Nessus	Red Hat Local Security Checks	2025/6/2	2025/10/9	medium
237650	RHEL 9 : varnish (RHSA-2025:8350)	Nessus	Red Hat Local Security Checks	2025/6/2	2025/10/9	medium
237656	Oracle Linux 8 : varnish:6 (ELSA-2025-8336)	Nessus	Oracle Linux Local Security Checks	2025/6/2	2025/9/11	medium
356623	Rocky Linux 8 [CIQ] Security Update: varnish / varnish-devel / varnish-docs / varnish-modules / etc (crlsa-2025_8336)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/2	medium
283212	MiracleLinux 8 : varnish:6 (AXSA:2025-9999:01)	Nessus	Miracle Linux Local Security Checks	2026/1/13	2026/1/20	medium
361729	AlmaLinux 9.2 [TuxCare] Security Update: varnish / varnish-devel / varnish-docs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763374645)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/2	medium
237462	Debian dla-4187 : libvarnishapi-dev - security update	Nessus	Debian Local Security Checks	2025/5/29	2025/5/29	medium
237633	RHEL 9 : varnish (RHSA-2025:8349)	Nessus	Red Hat Local Security Checks	2025/6/2	2025/10/9	medium
237642	RHEL 9 : varnish (RHSA-2025:8337)	Nessus	Red Hat Local Security Checks	2025/6/2	2025/10/9	medium
266514	RockyLinux 10 : varnish (RLSA-2025:8550)	Nessus	Rocky Linux Local Security Checks	2025/10/4	2025/10/4	medium
266533	RockyLinux 9 : varnish (RLSA-2025:8337)	Nessus	Rocky Linux Local Security Checks	2025/10/4	2025/10/4	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium