varnish - Debian Package Tracker

general

source: varnish (main)
version: 7.7.3-1
maintainer: Varnish Package Maintainers (DMD)
uploaders: Marco d'Itri [DMD] – Stig Sandbeck Mathisen [DMD]
arch: all any
std-ver: 4.7.2.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 6.5.1-1+deb11u3
o-o-sec: 6.5.1-1+deb11u5
oldstable: 7.1.1-1.1+deb12u1
old-sec: 7.1.1-2+deb12u1
old-p-u: 7.1.1-2+deb12u1
stable: 7.7.0-3
testing: 7.7.0-3
unstable: 7.7.3-1

versioned links

6.5.1-1+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.5.1-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.1.1-1.1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.1.1-2+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.7.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.7.3-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libvarnishapi-dev
libvarnishapi3
varnish
varnish-doc

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2025-8671: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

Created: 2025-08-14 Last update: 2025-08-25 07:29

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2025-8671: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

Created: 2025-08-14 Last update: 2025-08-25 07:29

3 security issues in bullseye high

There are 3 open security issues in bullseye.

1 important issue:

CVE-2025-8671: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

2 ignored issues:

CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

Created: 2025-08-14 Last update: 2025-08-25 07:29

3 security issues in bookworm high

There are 3 open security issues in bookworm.

1 important issue:

CVE-2025-8671: A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.

2 ignored issues:

CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

Created: 2023-11-17 Last update: 2025-08-25 07:29

3 security issues in buster high

There are 3 open security issues in buster.

2 important issues:

CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

1 issue postponed or untriaged:

CVE-2019-20637: (needs triaging) An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.

Created: 2023-11-17 Last update: 2024-04-05 18:00

The package has not entered testing even though the delay is over normal

The package has not entered testing even though the 5-day delay is over. Check why.

Created: 2025-08-30 Last update: 2025-09-01 10:35

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2025-07-21 Last update: 2025-09-01 07:00

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-08-14 Last update: 2025-08-14 11:01

debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 7.7.3-1 of the package, we noticed the following issues:

3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-08-25 12:02

Build log checks report 1 warning low

Build log checks report 1 warning

Created: 2024-07-20 Last update: 2024-07-20 05:48

testing migrations

excuses:
- Migrates after: libvmod-re2, libvmod-redis, libvmod-selector, varnish-modules, varnish-vmod-digest
- Migration status for varnish (7.7.0-3 to 7.7.3-1): BLOCKED: Rejected/violates migration policy/introduces a regression
- Issues preventing migration:
- ∙ ∙ migrating varnish/7.7.3-1/ppc64el to testing makes varnish-modules/0.25.0-2/ppc64el uninstallable
- ∙ ∙ autopkgtest for varnish/7.7.3-1: amd64: Pass, arm64: Pass, armhf: Pass, i386: Pass, ppc64el: Pass, riscv64: No tests, superficial or marked flaky ♻ (reference ♻), s390x: Pass
- ∙ ∙ autopkgtest for varnish-modules/0.25.0-2: ppc64el: Regression ♻ (reference ♻)
- ∙ ∙ autopkgtest for varnish-modules/0.26.0-2: amd64: Regression ♻ (reference ♻), arm64: Regression ♻ (reference ♻), i386: Regression ♻ (reference ♻), riscv64: Regression ♻ (reference ♻), s390x: Regression ♻ (reference ♻)
- ∙ ∙ Implicit dependency: varnish libvmod-re2
- ∙ ∙ Implicit dependency: varnish libvmod-redis
- ∙ ∙ Implicit dependency: varnish libvmod-selector
- ∙ ∙ Implicit dependency: varnish varnish-modules
- ∙ ∙ Implicit dependency: varnish varnish-vmod-digest
- Additional info:
- ∙ ∙ Piuparts tested OK - https://piuparts.debian.org/sid/source/v/varnish.html
- ∙ ∙ Reproducible on amd64 - info ♻
- ∙ ∙ Reproducible on arm64 - info ♻
- ∙ ∙ 7 days old (needed 5 days)
- Not considered

news

[rss feed]

[2025-08-24] Accepted varnish 7.7.3-1 (source) into unstable (Marco d'Itri)
[2025-08-17] Accepted varnish 7.7.2-2 (source) into unstable (Marco d'Itri)
[2025-08-14] Accepted varnish 7.7.2-1 (source) into unstable (Marco d'Itri)
[2025-06-20] Accepted varnish 7.7.1-1 (source) into experimental (Marco d'Itri)
[2025-06-13] varnish 7.7.0-3 MIGRATED to testing (Debian testing watch)
[2025-06-08] Accepted varnish 7.7.0-3 (source) into unstable (Marco d'Itri)
[2025-05-28] Accepted varnish 6.5.1-1+deb11u5 (source) into oldstable-security (Markus Koschany)
[2025-05-23] varnish 7.7.0-2 MIGRATED to testing (Debian testing watch)
[2025-05-17] Accepted varnish 7.1.1-2+deb12u1 (source amd64 all) into proposed-updates (Debian FTP Masters) (signed by: Marco d'Itri)
[2025-05-13] Accepted varnish 7.1.1-2+deb12u1 (source amd64 all) into stable-security (Debian FTP Masters) (signed by: Marco d'Itri)
[2025-05-13] Accepted varnish 7.7.0-2 (source) into unstable (Marco d'Itri)
[2025-04-14] Accepted varnish 7.1.1-1.1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
[2025-03-31] Accepted varnish 6.5.1-1+deb11u4 (source) into oldstable-security (Adrian Bunk)
[2025-03-26] varnish 7.7.0-1 MIGRATED to testing (Debian testing watch)
[2025-03-18] Accepted varnish 7.7.0-1 (source) into unstable (Marco d'Itri)
[2024-12-03] varnish 7.6.1-2 MIGRATED to testing (Debian testing watch)
[2024-11-29] Accepted varnish 7.6.1-2 (source) into unstable (Marco d'Itri)
[2024-11-18] Accepted varnish 7.6.1-1 (source) into experimental (Marco d'Itri)
[2024-10-27] varnish 7.6.0-2 MIGRATED to testing (Debian testing watch)
[2024-10-24] Accepted varnish 7.6.0-2 (source) into unstable (Marco d'Itri)
[2024-10-21] Accepted varnish 7.6.0-1 (source) into unstable (Marco d'Itri)
[2024-07-22] varnish 7.5.0-3 MIGRATED to testing (Debian testing watch)
[2024-07-19] Accepted varnish 7.5.0-3 (source) into unstable (Marco d'Itri)
[2024-07-09] varnish 7.5.0-2 MIGRATED to testing (Debian testing watch)
[2024-07-02] Accepted varnish 7.5.0-2 (source) into unstable (Marco d'Itri)
[2024-07-02] Accepted varnish 7.5.0-1 (source) into unstable (Marco d'Itri)
[2024-04-04] varnish 7.1.1-1.2 MIGRATED to testing (Debian testing watch)
[2024-04-01] Accepted varnish 7.1.1-1.2 (source) into unstable (Marco d'Itri)
[2023-12-23] varnish REMOVED from testing (Debian testing watch)
[2023-12-22] varnish REMOVED from testing (Debian testing watch)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 2)
buildd: logs, checks, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 7.7.0-3
11 bugs