CVE-2024-30156

2024-03-2401:15:45

Debian Security Bug Tracker

security-tracker.debian.org

varnish cache

varnish enterprise

broke window attack

http/2

credits exhaustion

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

OSVersionArchitecturePackageVersionFilename
Debian12allvarnish<= 7.1.1-1.1varnish_7.1.1-1.1_all.deb
Debian11allvarnish<= 6.5.1-1+deb11u3varnish_6.5.1-1+deb11u3_all.deb
Debian10allvarnish<= 6.1.1-1+deb10u3varnish_6.1.1-1+deb10u3_all.deb
Debian999allvarnish<= 7.1.1-1.2varnish_7.1.1-1.2_all.deb
Debian13allvarnish<= 7.1.1-1.2varnish_7.1.1-1.2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	varnish	<= 7.1.1-1.1	varnish_7.1.1-1.1_all.deb
Debian	11	all	varnish	<= 6.5.1-1+deb11u3	varnish_6.5.1-1+deb11u3_all.deb
Debian	10	all	varnish	<= 6.1.1-1+deb10u3	varnish_6.1.1-1+deb10u3_all.deb
Debian	999	all	varnish	<= 7.1.1-1.2	varnish_7.1.1-1.2_all.deb
Debian	13	all	varnish	<= 7.1.1-1.2	varnish_7.1.1-1.2_all.deb