Medium
Security advisory
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-36740
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:27 UTC · Revision 1
Source evidence
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.
osv:CVE-2021-36740
Complete source record
{
"id": "4f05ff662271cf7bc9648e17e2e6aa9cdd57708b1c98c33fae493309c6444148",
"url": "https://osv.dev/vulnerability/CVE-2021-36740",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-36740",
"summary": "Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.",
"evidence": "osv:CVE-2021-36740",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2021-36740",
"aliases": [
"BIT-varnish-2021-36740",
"CVE-2021-36740"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/varnishcache/varnish-cache",
"type": "GIT",
"events": [
{
"introduced": "99d036fe0b49c7487edb7dfd0da10fc2eef30505"
},
{
"last_affected": "67e56248220057f59f794ecc95d7a644b8492fef"
},
{
"introduced": "4684c38ecfc194b4f3b5b81594832dbb197a3bb9"
},
{
"last_affected": "ef54768fc10f5b19556c7cf9866efc88cfbda8ff"
},
{
"fixed": "82b0a629f60136e76112c6f2c6372cce77b683be"
},
{
"fixed": "9be22198e258d0e7a5c41f4291792214a29405cf"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.2.1"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "6.1.0"
},
{
"last_affected": "6.6.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "82b0a629f60136e76112c6f2c6372cce77b683be"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "9be22198e258d0e7a5c41f4291792214a29405cf"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"varnish-6.0.7",
"varnish-6.6.0",
"varnish-6.5.1",
"varnish-6.5.0",
"varnish-6.0.6",
"varnish-6.4.0",
"varnish-6.0.5",
"varnish-6.0.4",
"varnish-6.0.3",
"varnish-6.0.2",
"varnish-6.1.0",
"varnish-6.0.1",
"varnish-6.0.0",
"varnish-5.2.1",
"varnish-5.2.0",
"varnish-5.2.0-rc2",
"varnish-5.2.0-rc1",
"varnish-5.1.2",
"varnish-5.1.1",
"varnish-5.1.0",
"varnish-5.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-36740.json",
"vanir_signatures": [
{
"id": "CVE-2021-36740-40a11df2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96594679652235793478936197214739384428",
"339459041543529833794218464905202114607",
"279418260458959367168050697796270059616"
]
},
"source": "https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf",
"target": {
"file": "bin/varnishd/http2/cache_http2.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-53eab5af",
"digest": {
"threshold": 0.9,
"line_hashes": [
"319068846067141077674517737040206032799",
"274353302911709537974243764397932581341",
"208905520421134520460266232406743196538",
"73086315340845631618599290708976930073",
"45345459762820099820689968109526438325",
"340200689723017681936032407269823666538",
"131104118656162689643490246175672649667",
"328345390936522563376720596018008165721",
"76731877846164817541578033198421077993",
"128439728396422328233434357191828462337",
"107319550199931273783163815162928966657",
"81157401837015946607351207867327299215",
"97360033589979999387691178642859045922",
"73536272802941455868253792413217309254",
"338175314527739574972815094415174854982",
"35372504324213186992998909497482117632",
"141805938930458057492783450825077972424",
"95652761703888682500413291417301362049",
"144016718817270494714516261481624246524",
"23034497810754045751552518789258766638",
"250684336114939372379667006286775547711",
"234489751868536946923934456578626828431",
"261066693767689040588092339008749352082",
"77032436857494004235688079038925959168",
"201993082614027781764269695738784931002",
"224075334554160644837040476532160299252",
"87774922790116606955180312971410476114",
"272703658077891915828801242324228797896",
"2868793699174563681990444113713545452",
"196460651349024236897844127213278127554",
"125430785635549524489210990494404182027",
"132920814885250519596789044201833532554",
"67223240496591929872137056882178336880",
"222798785167562960086044945753951445944",
"171725439827953424882661539175816631452",
"311300411274644989261442296934303587302",
"248202766650665968777041095278730149429",
"110829078053625966343870111990685952478",
"211459360683093362770562507676684227624",
"12001120493820655175044509516892331829",
"78346852381289768209228900915764655954",
"289634711716964746914009452996406474211",
"215426642459140248912779234757462492466",
"332084814337334570559592300199245217027"
]
},
"source": "https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-6f018b40",
"digest": {
"length": 1723,
"function_hash": "289837936790979699010818898396070346431"
},
"source": "https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c",
"function": "h2_end_headers"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-890ec268",
"digest": {
"length": 1721,
"function_hash": "189079400166567416762404618048211487590"
},
"source": "https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c",
"function": "h2_rx_data"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-a8ddf732",
"digest": {
"length": 1266,
"function_hash": "250733975286537413943421660320081123180"
},
"source": "https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c",
"function": "h2_vfp_body"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-b4873106",
"digest": {
"threshold": 0.9,
"line_hashes": [
"321512367868134525491539838871430876084",
"53966348232674706180883999704314591993",
"112189269010713934362454945982987285093",
"83452261533668801857880234681874210620",
"126557411321562658525626135066837660832",
"138844621303148241755654140191731255422",
"106790144876060690172069889601222975062",
"60137546732818246979747965706000576656",
"336365565918691845243515060963439140418",
"155958802197505590868152760828239707175",
"272889598194545998678854085594421793864",
"132211763810066596212092125342379472967",
"291243419860909989710731087945611959123",
"48507533879275631949945225808360190879",
"158364661238759135933036554770533983942",
"338175314527739574972815094415174854982",
"35372504324213186992998909497482117632",
"141805938930458057492783450825077972424",
"95652761703888682500413291417301362049",
"144016718817270494714516261481624246524",
"23034497810754045751552518789258766638",
"250684336114939372379667006286775547711",
"234489751868536946923934456578626828431",
"261066693767689040588092339008749352082",
"77032436857494004235688079038925959168",
"201993082614027781764269695738784931002",
"224075334554160644837040476532160299252",
"87774922790116606955180312971410476114",
"272703658077891915828801242324228797896",
"2868793699174563681990444113713545452",
"196460651349024236897844127213278127554",
"125430785635549524489210990494404182027",
"132920814885250519596789044201833532554",
"67223240496591929872137056882178336880",
"222798785167562960086044945753951445944",
"171725439827953424882661539175816631452",
"311300411274644989261442296934303587302",
"248202766650665968777041095278730149429",
"110829078053625966343870111990685952478",
"211459360683093362770562507676684227624",
"12001120493820655175044509516892331829",
"78346852381289768209228900915764655954",
"289634711716964746914009452996406474211",
"215426642459140248912779234757462492466",
"332084814337334570559592300199245217027"
]
},
"source": "https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-c648d8d1",
"digest": {
"length": 1266,
"function_hash": "250733975286537413943421660320081123180"
},
"source": "https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c",
"function": "h2_vfp_body"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-d5bdb164",
"digest": {
"length": 1721,
"function_hash": "189079400166567416762404618048211487590"
},
"source": "https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c",
"function": "h2_rx_data"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-f02afbb1",
"digest": {
"length": 1607,
"function_hash": "238937024195301636687300950763608509409"
},
"source": "https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be",
"target": {
"file": "bin/varnishd/http2/cache_http2_proto.c",
"function": "h2_end_headers"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2021-36740-f1bb3ce2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"96594679652235793478936197214739384428",
"339459041543529833794218464905202114607",
"177132310497924254819981955067877769698"
]
},
"source": "https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be",
"target": {
"file": "bin/varnishd/http2/cache_http2.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:25:14Z"
}
}
],
"modified": "2026-10-24T14:25:14.164029866Z",
"provider": "osv",
"references": [
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK/",
"https://docs.varnish-software.com/security/VSV00007/",
"https://varnish-cache.org/security/VSV00007.html",
"https://www.debian.org/security/2022/dsa-5088",
"https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683be",
"https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cf"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:varnish-cache:varnish_cache:*:*:*:*:plus:*:*:*"
],
"vendor_product": "varnish-cache:varnish_cache",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.0"
},
{
"fixed": "6.0.8"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*",
"cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:lts:*:*:*"
],
"vendor_product": "varnish-software:varnish_cache",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.0"
},
{
"last_affected": "6.0.5"
},
{
"introduced": "6.0.0"
},
{
"last_affected": "6.0.7"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*"
],
"vendor_product": "varnish_cache_project:varnish_cache",
"extracted_events": [
{
"range": [
{
"introduced": "5.0.0"
},
{
"last_affected": "5.2.1"
},
{
"introduced": "6.1.0"
},
{
"last_affected": "6.6.0"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
},
{
"introduced": "11.0"
},
{
"last_affected": "11.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "33"
},
{
"last_affected": "33"
},
{
"introduced": "34"
},
{
"last_affected": "34"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:varnish-cache:varnish_cache:6.0.8:r1:*:*:plus:*:*:*",
"cpe:2.3:a:varnish-cache:varnish_cache:6.0.8:r2:*:*:plus:*:*:*"
],
"vendor_product": "varnish-cache:varnish_cache",
"extracted_events": [
{
"range": [
{
"introduced": "6.0.8-r1"
},
{
"last_affected": "6.0.8-r1"
},
{
"introduced": "6.0.8-r2"
},
{
"last_affected": "6.0.8-r2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2021-36740",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443746,
"published_at": "2021-07-14T17:15:08.253+00:00"
}