CVE-2017-12425
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if…
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | High7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 2.4% · top 16% of all CVEs (3 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
Affected products
n/a
- affected n/a
References (6)
- https://www.varnish-cache.org/security/VSV00001.html#vsv00001 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://lists.debian.org/debian-security-announce/2017/msg00186.html (opens in a new tab)x_refsource_CONFIRMx_transferred
- DSA-3924 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
- https://bugzilla.suse.com/show_bug.cgi?id=1051917 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=1477222 (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://github.com/varnishcache/varnish-cache/issues/2379 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-12425)Record last updated .