UpHeron
All vulnerabilities

Servers and applications

CVE-2017-12425

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker…

Severity
High 7.5
Published
4 Aug 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
2.4% in the next 30 daysHigher than 84% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Integer overflow (CWE-190)
Attack
Over the network · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
NVD

Description

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.

From NVD.

Affected software

SoftwareAffected versions
Varnish CacheServers and applications · cpe:a:varnish-software:varnish_cache
  • Version 4.1.7
  • Version 4.1.6
  • Version 4.1.5
  • Version 4.1.5-beta2
All 20 release lines
  • Version 4.1.0-beta1
  • Version 4.1.0-technology_preview1
  • Version 4.1.1-beta1
  • Version 4.1.1-beta2
  • Version 4.1.1
  • Version 4.1.2-beta1
  • Version 4.1.2-beta2
  • Version 4.1.2
  • Version 4.1.3-beta1
  • Version 4.1.3-beta2
  • Version 4.1.3
  • Version 4.1.4-beta1
  • Version 4.1.4-beta2
  • Version 4.1.4-beta3
  • Version 4.1.4
  • Version 4.1.5-beta1
  • Version 4.1.5-beta2
  • Version 4.1.5
  • Version 4.1.6
  • Version 4.1.7
Varnish CacheServers and applications · cpe:a:varnish_cache_project:varnish_cache
  • Version 5.1.2
  • Version 5.1.1
  • Version 5.1.0
  • Version 5.0.0
All 8 release lines
  • Version 4.0.1
  • Version 4.0.2
  • Version 4.0.3
  • Version 4.0.4
  • Version 5.0.0
  • Version 5.1.0
  • Version 5.1.1
  • Version 5.1.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-12425
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-12425