CVE-2022-45059

HIGH LAB

Varnish Cache 7.x < 7.1.2 and 7.2.x < 7.2.1 - HTTP Request Smuggling via Hop-by-Hop Header Handling

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-45059. PoCs published by martinvks.

AI-analyzed exploit summary This repository demonstrates CVE-2022-45059, a request smuggling vulnerability in Varnish Cache versions 7.0.0-7.2.0. It includes a Spring Boot application behind a vulnerable Varnish instance to showcase cookie theft via hop-by-hop Content-Length header manipulation.

Description

An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend.

Exploits (1)

nomisec WORKING POC
by martinvks · poc
https://github.com/martinvks/CVE-2022-45059-demo

This repository demonstrates CVE-2022-45059, a request smuggling vulnerability in Varnish Cache versions 7.0.0-7.2.0. It includes a Spring Boot application behind a vulnerable Varnish instance to showcase cookie theft via hop-by-hop Content-Length header manipulation.

Classification
Working Poc 95%
Attack Type
Other
Complexity
Moderate
Reliability
Reliable
Target: Varnish Cache 7.0.0-7.2.0
No auth needed
Prerequisites: Vulnerable Varnish Cache version · Access to backend server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.5
EPSS 0.0120
EPSS Percentile 64.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Lab Environment

COMMUNITY
Community Lab
docker pull amazoncorretto:17
docker pull martinvks/cve-2022-45059-frontend
docker pull martinvks/cve-2022-45059-backend
docker pull martinvks/cve-2022-45059-victim
docker pull nicolaka/netshoot
+1 more images

Details

CWE
CWE-444
Status published
Products (5)
fedoraproject/fedora 35
fedoraproject/fedora 36
fedoraproject/fedora 37
varnish_cache_project/varnish_cache 7.2.0
varnish_cache_project/varnish_cache 7.0.0 - 7.1.2
Published Nov 09, 2022
Tracked Since Feb 18, 2026