-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 18:03:52 +0800
Source: varnish
Architecture: source
Version: 7.7.0-3+deb13u2
Distribution: trixie-security
Urgency: medium
Maintainer: Varnish Package Maintainers <team+varnish-team@tracker.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Changes:
varnish (7.7.0-3+deb13u2) trixie-security; urgency=medium
.
* Non-maintainer upload by the Security Team.
* Backport the VSV00020 case-conversion workspace overflow fix
(CVE-2026-93894), with regression tests.
* Backport the complete VSV00018 absolute-form request normalization
fix (CVE-2026-34475): validate request URLs, enable HTTPS
normalization by default while preserving opt-out, and cover empty
paths and query-only targets.
Checksums-Sha1:
edf43e86aa325e8feb9cc69e74805b720f700da0 2080 varnish_7.7.0-3+deb13u2.dsc
e8c0f3f5c5cc9d2f5e44b6f73882b87f3ef9969f 34220 varnish_7.7.0-3+deb13u2.debian.tar.xz
e2ea281a7fb3369349a2121ba3fe6e504bd0a629 9921 varnish_7.7.0-3+deb13u2_source.buildinfo
Checksums-Sha256:
6ba990adf51ba2946d0980f02d2fe2d1d3968e3950c2b28632587e91bd961ea4 2080 varnish_7.7.0-3+deb13u2.dsc
e2d46b83b5dfa71caba6b0bc74cde4d423b705d0377d91d7005de975b8565caa 34220 varnish_7.7.0-3+deb13u2.debian.tar.xz
c97462c7adc516305ca8ad590d68bbc9cf589f3039d889f8d16c8796d916f3ef 9921 varnish_7.7.0-3+deb13u2_source.buildinfo
Files:
15b64568365df23daf251927b5407c0f 2080 web optional varnish_7.7.0-3+deb13u2.dsc
bb3afe501d5d524fec1df09df413a581 34220 web optional varnish_7.7.0-3+deb13u2.debian.tar.xz
946b61c8a89ee9b191a7c6ffaba4569c 9921 web optional varnish_7.7.0-3+deb13u2_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmrcgrAACgkQ+GQ1dHE8
m67Uywf/e3rhsTn7nxgzqD40pJs6Nb4Axkr8evE5RjHMNKQbOynzrccsNfOzSFiO
+tuEJFbsk2FuDdw9THVG1azQ93VHnpR8qvtv0lfwSlJbUs26p80bT5tWSuOVMoD/
O53vpQU+DZF4cv7eWZ7GH/uCe22eE5WfsO42HdO2zaS+zei5/GoJUUOrbXVtv+Rf
VUmXiX3INzDihq82CNAvwMirHc3e3nsVkMuJ/Ait9j5lOimdkEVeTbqXROdotLvZ
cD3apYW01rLVKhBGhl8k0oB/FXGl4vSdiRTjsFRtmegLZYSFCsgcjpNeoZOyFqa/
AcTHv5CUpLvyHJYUITT6aW1Jur1WhQ==
=lYj7
-----END PGP SIGNATURE-----
