Martin Van Kervel Smedshammer

**Name of the Vulnerable Software and Affected Versions** Spring Boot versions 2.5.0 through 2.5.14 Spring Boot versions 2.6.0 through 2.6.14 Spring Boot versions 2.7.0 through 2.7.11 Spring Boot versions 3.0.0 through 3.0.6 Spring Boot older unsupported versions **Description** There is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache. An application is vulnerable if it has Spring MVC auto-configuration enabled, makes use of Spring Boot's welcome page support, and is deployed behind a proxy that caches 404 responses. **Recommendations** For Spring Boot versions 2.5.x, upgrade to 2.5.15 or later. For Spring Boot versions 2.6.x, upgrade to 2.6.15 or later. For Spring Boot versions 2.7.x, upgrade to 2.7.12 or later. For Spring Boot versions 3.0.x, upgrade to 3.0.7 or later. For older, unsupported Spring Boot versions, upgrade to 3.0.7 or 2.7.12 or later. As a temporary workaround, consider configuring the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.

**Name of the Vulnerable Software and Affected Versions** Varnish Cache versions 7.0.0 through 7.1.1 Varnish Cache versions 7.2.0 through 7.2.0 **Description** An issue was discovered in Varnish Cache, allowing a request smuggling attack to be performed on Varnish Cache servers. This occurs when certain headers are requested to be made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend. **Recommendations** For Varnish Cache versions 7.0.0 through 7.1.1, update to version 7.1.2 or later. For Varnish Cache versions 7.2.0 through 7.2.0, update to version 7.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Varnish Cache versions 5.x through 6.0.10 Varnish Cache versions 7.x through 7.1.1 Varnish Cache versions 7.2.x through 7.2.0 **Description** An HTTP Request Forgery issue was discovered in Varnish Cache, where an attacker may introduce characters through HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This could be used to exploit vulnerabilities in a server behind the Varnish server. **Recommendations** For Varnish Cache versions 5.x through 6.0.10, update to version 6.0.11 or later. For Varnish Cache versions 7.x through 7.1.1, update to version 7.1.2 or later. For Varnish Cache versions 7.2.x through 7.2.0, update to version 7.2.1 or later. As a temporary workaround, consider restricting access to the Varnish server to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Varnish Cache versions prior to 6.0.6 LTS Varnish Cache versions 6.1.x Varnish Cache versions 6.2.x prior to 6.2.3 Varnish Cache versions 6.3.x prior to 6.3.2 **Description** An issue occurs in Varnish Cache when communication with a TLS termination proxy uses PROXY version 2, leading to an assertion failure and daemon restart. This results in a performance loss. **Recommendations** For versions prior to 6.0.6 LTS, update to version 6.0.6 LTS or later. For versions 6.1.x, update to version 6.2.3 or later. For versions 6.2.x prior to 6.2.3, update to version 6.2.3 or later. For versions 6.3.x prior to 6.3.2, update to version 6.3.2 or later.