CVE-2021-36740

A flaw was found in Varnish. The Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. As a result, this flaw allows the information on the Varnish cache to be poisoned. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Mitigation

This issue can be mitigated by:

1. Disabling HTTP/2 request support by executing:

   sudo varnishadm param.set feature -http2

2. Disabling backend connection reuse on varnish side, the following rule can be inserted into Varnish configuration:

   sub vcl_backend_fetch {
   set bereq.http.Connection = “close”;
   }