Debian Package Tracker
Register | Log in
Subscribe

varnish

state of the art, high-performance web accelerator

Choose email to subscribe with

general
  • source: varnish (main)
  • version: 7.7.0-3
  • maintainer: Varnish Package Maintainers (DMD)
  • uploaders: Stig Sandbeck Mathisen [DMD] – Marco d'Itri [DMD]
  • arch: all any
  • std-ver: 4.7.2.0
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 6.1.1-1+deb10u3
  • o-o-sec: 6.1.1-1+deb10u4
  • oldstable: 6.5.1-1+deb11u3
  • old-sec: 6.5.1-1+deb11u5
  • stable: 7.1.1-1.1+deb12u1
  • stable-sec: 7.1.1-2+deb12u1
  • stable-p-u: 7.1.1-2+deb12u1
  • testing: 7.7.0-3
  • unstable: 7.7.0-3
versioned links
  • 6.1.1-1+deb10u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.1.1-1+deb10u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.5.1-1+deb11u3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 6.5.1-1+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 7.1.1-1.1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 7.1.1-2+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 7.7.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • libvarnishapi-dev
  • libvarnishapi3
  • varnish
  • varnish-doc
action needed
A new upstream version is available: 7.7.1 high
A new upstream version 7.7.1 is available, you should consider packaging it.
Created: 2025-05-13 Last update: 2025-06-20 00:03
3 security issues in buster high

There are 3 open security issues in buster.

2 important issues:
  • CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
  • CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
1 issue postponed or untriaged:
  • CVE-2019-20637: (needs triaging) An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6.3.1. It does not clear a pointer between the handling of one client request and the next request within the same connection. This sometimes causes information to be disclosed from the connection workspace, such as data structures associated with previous requests within this connection or VCL-related temporary headers.
Created: 2023-11-17 Last update: 2024-04-05 18:00
Fails to build during reproducibility testing normal
A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!
Created: 2025-06-14 Last update: 2025-06-20 02:32
debian/patches: 3 patches to forward upstream low

Among the 3 debian patches available in version 7.7.0-3 of the package, we noticed the following issues:

  • 3 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2025-06-09 00:04
Build log checks report 1 warning low
Build log checks report 1 warning
Created: 2024-07-20 Last update: 2024-07-20 05:48
No known security issue in bookworm wishlist

There are 2 open security issues in bookworm.

2 ignored issues:
  • CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
  • CVE-2024-30156: Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.
Created: 2023-11-17 Last update: 2025-06-13 05:33
news
[rss feed]
  • [2025-06-13] varnish 7.7.0-3 MIGRATED to testing (Debian testing watch)
  • [2025-06-08] Accepted varnish 7.7.0-3 (source) into unstable (Marco d'Itri)
  • [2025-05-28] Accepted varnish 6.5.1-1+deb11u5 (source) into oldstable-security (Markus Koschany)
  • [2025-05-23] varnish 7.7.0-2 MIGRATED to testing (Debian testing watch)
  • [2025-05-17] Accepted varnish 7.1.1-2+deb12u1 (source amd64 all) into proposed-updates (Debian FTP Masters) (signed by: Marco d'Itri)
  • [2025-05-13] Accepted varnish 7.1.1-2+deb12u1 (source amd64 all) into stable-security (Debian FTP Masters) (signed by: Marco d'Itri)
  • [2025-05-13] Accepted varnish 7.7.0-2 (source) into unstable (Marco d'Itri)
  • [2025-04-14] Accepted varnish 7.1.1-1.1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Adrian Bunk)
  • [2025-03-31] Accepted varnish 6.5.1-1+deb11u4 (source) into oldstable-security (Adrian Bunk)
  • [2025-03-26] varnish 7.7.0-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-18] Accepted varnish 7.7.0-1 (source) into unstable (Marco d'Itri)
  • [2024-12-03] varnish 7.6.1-2 MIGRATED to testing (Debian testing watch)
  • [2024-11-29] Accepted varnish 7.6.1-2 (source) into unstable (Marco d'Itri)
  • [2024-11-18] Accepted varnish 7.6.1-1 (source) into experimental (Marco d'Itri)
  • [2024-10-27] varnish 7.6.0-2 MIGRATED to testing (Debian testing watch)
  • [2024-10-24] Accepted varnish 7.6.0-2 (source) into unstable (Marco d'Itri)
  • [2024-10-21] Accepted varnish 7.6.0-1 (source) into unstable (Marco d'Itri)
  • [2024-07-22] varnish 7.5.0-3 MIGRATED to testing (Debian testing watch)
  • [2024-07-19] Accepted varnish 7.5.0-3 (source) into unstable (Marco d'Itri)
  • [2024-07-09] varnish 7.5.0-2 MIGRATED to testing (Debian testing watch)
  • [2024-07-02] Accepted varnish 7.5.0-2 (source) into unstable (Marco d'Itri)
  • [2024-07-02] Accepted varnish 7.5.0-1 (source) into unstable (Marco d'Itri)
  • [2024-04-04] varnish 7.1.1-1.2 MIGRATED to testing (Debian testing watch)
  • [2024-04-01] Accepted varnish 7.1.1-1.2 (source) into unstable (Marco d'Itri)
  • [2023-12-23] varnish REMOVED from testing (Debian testing watch)
  • [2023-12-22] varnish REMOVED from testing (Debian testing watch)
  • [2023-01-31] Accepted varnish 6.5.1-1+deb11u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2023-01-29] Accepted varnish 6.5.1-1+deb11u3 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
  • [2023-01-18] varnish 7.1.1-1.1 MIGRATED to testing (Debian testing watch)
  • [2023-01-12] Accepted varnish 7.1.1-1.1 (source) into unstable (Salvatore Bonaccorso)
  • 1
  • 2
bugs [bug history graph]
  • all: 1
  • RC: 0
  • I&N: 1
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian
  • buildd: logs, checks, reproducibility, cross
  • popcon
  • browse source code
  • edit tags
  • other distros
  • security tracker
  • screenshots
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 7.7.0-2
  • 10 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing