Lucene search

MitreVULNRICHMENT:CVE-2024-30156

HistoryMar 24, 2024 - 12:00 a.m.

CVE-2024-30156

2024-03-2400:00:00

mitre

github.com

varnish cache

varnish enterprise

http/2

credits exhaustion

control flow window

broke window attack

AI Score

6.8

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhaustion for an HTTP/2 connection control flow window, aka a Broke Window Attack.

References

varnish-cache.org/docs/7.5/whats-new/changes-7.5.html#security

varnish-cache.org/security/VSV00014.html