CVE-2025-47905 Overview
CVE-2025-47905 is an HTTP request smuggling vulnerability affecting Varnish Cache and Varnish Enterprise. The flaw resides in the HTTP/1 parser, which incorrectly permits carriage return line feed (CRLF) sequences to be skipped when delimiting chunked transfer-encoding boundaries. Attackers can exploit this behavior to perform client-side desync attacks against downstream clients.
The issue is tracked as CWE-444: Inconsistent Interpretation of HTTP Requests. Affected versions include Varnish Cache before 7.6.3, Varnish Cache 7.7 before 7.7.1, and Varnish Enterprise before 6.0.13r14.
Critical Impact
Successful exploitation enables client-side desync attacks against users of a shared cache, potentially leading to cache poisoning, credential theft, and cross-user data exposure.
Affected Products
- Varnish Cache versions before 7.6.3
- Varnish Cache 7.7 before 7.7.1
- Varnish Enterprise before 6.0.13r14
Discovery Timeline
- 2025-05-13 - CVE-2025-47905 published to the National Vulnerability Database
- 2025-05-15 - Advisory distributed on the OpenWall oss-security mailing list
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47905
Vulnerability Analysis
The vulnerability stems from an HTTP/1 chunked transfer-encoding parser that fails to strictly enforce CRLF framing between chunk boundaries. According to Varnish Security Advisory VSV00016, the parser permits chunks to be delimited without the required CRLF terminator. This deviation from RFC 9112 allows a malicious server or intermediary to construct responses that Varnish frames differently than downstream HTTP clients.
Because Varnish operates as a shared front-end cache, request framing inconsistencies propagate to every user routed through the affected instance. An attacker can smuggle response boundaries so that a subsequent legitimate client receives attacker-controlled content or has its request treated as part of a prior response body.
Root Cause
The root cause is lenient parsing of chunked encoding terminators. RFC 9112 Section 7.1 requires each chunk to be followed by a CRLF sequence. The affected Varnish parser accepts chunks that skip this delimiter, producing an interpretation mismatch between Varnish and other HTTP/1 speakers in the request path.
Attack Vector
Exploitation requires an attacker to induce a victim browser or client to issue crafted HTTP/1 requests through Varnish, or to control a back-end response that Varnish will forward or cache. When Varnish and the client disagree on where one message ends and the next begins, the attacker can bind malicious content to a victim's session. This is a client-side desync variant of HTTP request smuggling, described in detail in the Debian LTS announcement and the OpenWall advisory post.
No public proof-of-concept exploit code is currently available. Refer to the vendor advisory for full technical details.
Detection Methods for CVE-2025-47905
Indicators of Compromise
- HTTP/1 requests or responses containing chunked bodies where chunk data is not followed by a CRLF terminator before the next chunk-size line.
- Anomalous cache hits serving content that does not correspond to the requested URL or Host header.
- Unexpected response bodies delivered to clients that requested unrelated resources.
Detection Strategies
- Deploy a strict HTTP/1 parser or web application firewall in front of Varnish to reject non-conforming chunked encoding.
- Inspect Varnish access logs (varnishncsa) for response length or status anomalies correlated with clustered client IPs.
- Compare request framing between Varnish and origin logs to identify boundary disagreements.
Monitoring Recommendations
- Alert on spikes in 4xx responses from origin servers reached through Varnish, which can indicate framing rejections.
- Monitor for repeated identical request patterns targeting cacheable endpoints from a single source.
- Enable telemetry on Transfer-Encoding: chunked traffic volume and flag deviations from baseline.
How to Mitigate CVE-2025-47905
Immediate Actions Required
- Upgrade Varnish Cache to 7.6.3 or 7.7.1, and Varnish Enterprise to 6.0.13r14 or later.
- Audit all HTTP/1 upstream and downstream components for RFC 9112 compliance.
- Review cache contents and purge entries that may have been poisoned during the exposure window.
Patch Information
Fixed releases are published by the Varnish project. See the Varnish Cache Security Advisory VSV00016 for release links. Debian users should apply the updates described in the Debian LTS Announcement.
Workarounds
- Terminate TLS and normalize HTTP/1 traffic through a strict-parsing reverse proxy before it reaches Varnish.
- Disable client acceptance of Transfer-Encoding: chunked on trust-boundary tiers where feasible.
- Restrict access to Varnish administration and origin paths to reduce the pool of attackers who can influence cached content.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
