« Volver al listado

CVE-2025-47905

Estado: AplazadaMedia (5.4)—

Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Varnish — Varnish CacheAIVarnish-software — Varnish EnterpriseAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-47905",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-47905",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-14T14:15:16.258197Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "varnish-software",
          "product": "Varnish Cache",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.0.14 LTS",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.0.0",
              "lessThan": "7.6.3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "7.7.0",
              "lessThan": "7.7.1",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-13T22:15:24.990",
  "references": [
    {
      "url": "https://varnish-cache.org/security/VSV00016.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2025/05/15/2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00040.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Varnish Cache before 7.6.3 and 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14, allow client-side desync via HTTP/1 requests, because the product incorrectly permits CRLF to be skipped to delimit chunk boundaries."
    },
    {
      "lang": "es",
      "value": "Varnish Cache anterior a 7.6.3 y 7.7 anterior a 7.7.1, y Varnish Enterprise anterior a 6.0.13r14, permiten la desincronización del lado del cliente a través de solicitudes HTTP/1, porque el producto permite incorrectamente que se omita CRLF para delimitar los límites de los fragmentos."
    }
  ],
  "lastModified": "2026-06-17T09:28:49.247",
  "sourceIdentifier": "cve@mitre.org"
}