# varnish security updates

Patch Radar has 73 security fixes for varnish, closing 16 CVEs, 1 of which is being exploited. The newest security fix is OPENSUSE-SU-2026:22131-1 (7.7.3-bp160.1.1), released November 7, 2026.

- Web page: https://patchblox.com/security/product/linux/varnish
- Platform: Linux
- Supported: yes

## Security fixes, newest first

| Fix | Released | Fixed in | Priority | CVEs | Exploited |
|---|---|---|---|---:|---:|
| [OPENSUSE-SU-2026:22131-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-22131-1.md) | Nov 7, 2026 | opensuse-leap 16.0 7.7.3-bp160.1.1 | High | 2 | 0 |
| [DEBIAN-CVE-2026-93894](https://patchblox.com/security/data/fix/linux/debian-cve-2026-93894.md) | Sep 18, 2026 | Debian 13.5 (trixie) 7.7.0-3+deb13u2 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-50052](https://patchblox.com/security/data/fix/linux/debian-cve-2026-50052.md) | Jun 24, 2026 | Debian 13.5 (trixie) 7.7.0-3+deb13u1 | Routine | 1 | 0 |
| [DEBIAN-CVE-2026-34475](https://patchblox.com/security/data/fix/linux/debian-cve-2026-34475.md) | Mar 27, 2026 | Debian 13.5 (trixie) 7.7.0-3+deb13u2 | Urgent | 1 | 0 |
| [RLSA-2025:8337](https://patchblox.com/security/data/fix/linux/rlsa-2025-8337.md) | Oct 4, 2025 | rocky 9 0:6.6.2-6.el9_6.1 | High | 1 | 0 |
| [RLSA-2025:8550](https://patchblox.com/security/data/fix/linux/rlsa-2025-8550.md) | Oct 3, 2025 | rocky 10 0:7.6.1-2.el10_0.1 | High | 1 | 0 |
| [DEBIAN-CVE-2025-8671](https://patchblox.com/security/data/fix/linux/debian-cve-2025-8671.md) | Aug 13, 2025 | Debian 13.5 (trixie) 7.7.0-3+deb13u1 | High | 1 | 0 |
| [RLSA-2025:8336](https://patchblox.com/security/data/fix/linux/rlsa-2025-8336.md) | Jul 29, 2025 | rocky 8 0:6.0.13-1.module+el8.10.0+1982+334a201b.1 | High | 1 | 0 |
| [ELSA-2025-8550](https://patchblox.com/security/data/fix/linux/elsa-2025-8550.md) | Jun 26, 2025 | ol 10 0:7.6.1-2.el10_0.1 | High | 1 | 0 |
| [ALSA-2025:8550](https://patchblox.com/security/data/fix/linux/alsa-2025-8550.md) | Jun 4, 2025 | almalinux 10 7.6.1-2.el10_0.1 | High | 1 | 0 |
| [ALSA-2025:8336](https://patchblox.com/security/data/fix/linux/alsa-2025-8336.md) | Jun 2, 2025 | almalinux 8 6.0.13-1.module_el8.10.0+4003+9759c3c1.1 | High | 1 | 0 |
| [ALSA-2025:8337](https://patchblox.com/security/data/fix/linux/alsa-2025-8337.md) | Jun 2, 2025 | almalinux 9 6.6.2-6.el9_6.1 | High | 1 | 0 |
| [ELSA-2025-8336](https://patchblox.com/security/data/fix/linux/elsa-2025-8336.md) | Jun 2, 2025 | ol 8 0:6.0.13-1.module+el8.10.0+90594+95ad0b53.1 | High | 1 | 0 |
| [ELSA-2025-8337](https://patchblox.com/security/data/fix/linux/elsa-2025-8337.md) | Jun 2, 2025 | ol 9 0:6.6.2-6.el9_6.1 | High | 1 | 0 |
| [RHSA-2025:8336](https://patchblox.com/security/data/fix/linux/rhsa-2025-8336.md) | Jun 2, 2025 | RHEL 8 0:6.0.13-1.module+el8.10.0+23111+831cc069.1 | High | 1 | 0 |
| [RHSA-2025:8337](https://patchblox.com/security/data/fix/linux/rhsa-2025-8337.md) | Jun 2, 2025 | RHEL 9 0:6.6.2-6.el9_6.1 | High | 1 | 0 |
| [DLA-4187-1](https://patchblox.com/security/data/fix/linux/dla-4187-1.md) | May 28, 2025 | Debian 11.6 (bullseye) 6.5.1-1+deb11u5 | High | 1 | 0 |
| [DEBIAN-CVE-2025-47905](https://patchblox.com/security/data/fix/linux/debian-cve-2025-47905.md) | May 13, 2025 | Debian 12.15 (bookworm) 7.1.1-2+deb12u1 | High | 1 | 0 |
| [DEBIAN-CVE-2025-47905](https://patchblox.com/security/data/fix/linux/debian-cve-2025-47905.md) | May 13, 2025 | Debian 13.5 (trixie) 7.7.0-2 | High | 1 | 0 |
| [RHSA-2025:8550](https://patchblox.com/security/data/fix/linux/rhsa-2025-8550.md) | May 13, 2025 | RHEL 10 7.6.1-2.el10_0.1 | High | 1 | 0 |
| [DSA-5918-1](https://patchblox.com/security/data/fix/linux/dsa-5918-1.md) | May 13, 2025 | Debian 12.15 (bookworm) 7.1.1-2+deb12u1 | Routine | 1 | 0 |
| [DLA-4101-1](https://patchblox.com/security/data/fix/linux/dla-4101-1.md) | Mar 31, 2025 | Debian 11.6 (bullseye) 6.5.1-1+deb11u4 | Routine | 1 | 0 |
| [DEBIAN-CVE-2025-30346](https://patchblox.com/security/data/fix/linux/debian-cve-2025-30346.md) | Mar 21, 2025 | Debian 13.5 (trixie) 7.7.0-1 | Routine | 1 | 0 |
| [RLSA-2024:1691](https://patchblox.com/security/data/fix/linux/rlsa-2024-1691.md) | May 10, 2024 | rocky 9 0:6.6.2-4.el9_3.1 | High | 1 | 0 |
| [RLSA-2024:1690](https://patchblox.com/security/data/fix/linux/rlsa-2024-1690.md) | May 6, 2024 | rocky 8 0:6.0.13-1.module+el8.9.0+1777+0acf9965 | High | 1 | 0 |
| [ELSA-2024-1690](https://patchblox.com/security/data/fix/linux/elsa-2024-1690.md) | Apr 9, 2024 | ol 8 0:6.0.13-1.module+el8.9.0+90264+d552af1c | High | 1 | 0 |
| [ELSA-2024-1691](https://patchblox.com/security/data/fix/linux/elsa-2024-1691.md) | Apr 9, 2024 | ol 9 0:6.6.2-4.el9_3.1 | High | 1 | 0 |
| [ALSA-2024:1690](https://patchblox.com/security/data/fix/linux/alsa-2024-1690.md) | Apr 8, 2024 | almalinux 8 6.0.13-1.module_el8.9.0+3786+e8a73bbf.alma.1 | High | 1 | 0 |
| [ALSA-2024:1691](https://patchblox.com/security/data/fix/linux/alsa-2024-1691.md) | Apr 8, 2024 | almalinux 9 6.6.2-4.el9_3.1 | High | 1 | 0 |
| [RHSA-2024:1690](https://patchblox.com/security/data/fix/linux/rhsa-2024-1690.md) | Apr 8, 2024 | RHEL 8 0:6.0.13-1.module+el8.9.0+21617+7578fa11 | High | 1 | 0 |
| [RHSA-2024:1691](https://patchblox.com/security/data/fix/linux/rhsa-2024-1691.md) | Apr 8, 2024 | RHEL 9 0:6.6.2-4.el9_3.1 | High | 1 | 0 |
| [DEBIAN-CVE-2024-30156](https://patchblox.com/security/data/fix/linux/debian-cve-2024-30156.md) | Mar 24, 2024 | Debian 13.5 (trixie) 7.5.0-1 | High | 1 | 0 |
| [RLSA-2023:5924](https://patchblox.com/security/data/fix/linux/rlsa-2023-5924.md) | Oct 24, 2023 | rocky 9 0:6.6.2-3.el9_2.1 | Patch now | 1 | 1 |
| [RLSA-2023:5989](https://patchblox.com/security/data/fix/linux/rlsa-2023-5989.md) | Oct 24, 2023 | rocky 8 0:6.0.8-3.module+el8.8.0+1552+3570c668.1 | Patch now | 1 | 1 |
| [ELSA-2023-5924](https://patchblox.com/security/data/fix/linux/elsa-2023-5924.md) | Oct 24, 2023 | ol 9 0:6.6.2-3.el9_2.1 | Patch now | 1 | 1 |
| [ELSA-2023-5989](https://patchblox.com/security/data/fix/linux/elsa-2023-5989.md) | Oct 24, 2023 | ol 8 0:6.0.8-3.module+el8.8.0+21197+bdc2c048.1 | Patch now | 1 | 1 |
| [ALSA-2023:5989](https://patchblox.com/security/data/fix/linux/alsa-2023-5989.md) | Oct 23, 2023 | almalinux 8 6.0.8-3.module_el8.8.0+3665+0b8dabc5.1.alma.1 | Patch now | 1 | 1 |
| [RHSA-2023:5989](https://patchblox.com/security/data/fix/linux/rhsa-2023-5989.md) | Oct 23, 2023 | RHEL 8 0:6.0.8-3.module+el8.8.0+20455+bdc2c048.1 | Patch now | 1 | 1 |
| [ALSA-2023:5924](https://patchblox.com/security/data/fix/linux/alsa-2023-5924.md) | Oct 19, 2023 | almalinux 9 6.6.2-3.el9_2.1 | Patch now | 1 | 1 |
| [RHSA-2023:5924](https://patchblox.com/security/data/fix/linux/rhsa-2023-5924.md) | Oct 19, 2023 | RHEL 9 0:6.6.2-3.el9_2.1 | Patch now | 1 | 1 |
| [DEBIAN-CVE-2023-44487](https://patchblox.com/security/data/fix/linux/debian-cve-2023-44487.md) | Oct 10, 2023 | Debian 13.5 (trixie) 7.5.0-1 | Patch now | 1 | 1 |
| [DSA-5334-1](https://patchblox.com/security/data/fix/linux/dsa-5334-1.md) | Jan 29, 2023 | Debian 11.6 (bullseye) 6.5.1-1+deb11u3 | High | 1 | 0 |
| [ELSA-2022-8643](https://patchblox.com/security/data/fix/linux/elsa-2022-8643.md) | Nov 29, 2022 | ol 9 0:6.6.2-2.el9_1.1 | High | 1 | 0 |
| [RLSA-2022:8649](https://patchblox.com/security/data/fix/linux/rlsa-2022-8649.md) | Nov 28, 2022 | rocky 8 0:6.0.8-2.module+el8.7.0+1094+66cdd070.1 | High | 1 | 0 |
| [RLSA-2022:8643](https://patchblox.com/security/data/fix/linux/rlsa-2022-8643.md) | Nov 28, 2022 | rocky 9 0:6.6.2-2.el9_1.1 | High | 1 | 0 |
| [ALSA-2022:8643](https://patchblox.com/security/data/fix/linux/alsa-2022-8643.md) | Nov 28, 2022 | almalinux 9 6.6.2-2.el9_1.1 | High | 1 | 0 |
| [ALSA-2022:8649](https://patchblox.com/security/data/fix/linux/alsa-2022-8649.md) | Nov 28, 2022 | almalinux 8 6.0.8-2.module_el8.7.0+3353+b11d8f2f.1 | High | 1 | 0 |
| [ELSA-2022-8649](https://patchblox.com/security/data/fix/linux/elsa-2022-8649.md) | Nov 28, 2022 | ol 8 0:6.0.8-2.module+el8.7.0+20885+cb213da4.1 | High | 1 | 0 |
| [RHSA-2022:8643](https://patchblox.com/security/data/fix/linux/rhsa-2022-8643.md) | Nov 28, 2022 | RHEL 9 0:6.6.2-2.el9_1.1 | High | 1 | 0 |
| [RHSA-2022:8649](https://patchblox.com/security/data/fix/linux/rhsa-2022-8649.md) | Nov 28, 2022 | RHEL 8 0:6.0.8-2.module+el8.7.0+17239+94d153bd.1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-45059](https://patchblox.com/security/data/fix/linux/debian-cve-2022-45059.md) | Nov 9, 2022 | Debian 12.15 (bookworm) 7.1.1-1.1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-45059](https://patchblox.com/security/data/fix/linux/debian-cve-2022-45059.md) | Nov 9, 2022 | Debian 13.5 (trixie) 7.1.1-1.1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-45060](https://patchblox.com/security/data/fix/linux/debian-cve-2022-45060.md) | Nov 9, 2022 | Debian 12.15 (bookworm) 7.1.1-1.1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-45060](https://patchblox.com/security/data/fix/linux/debian-cve-2022-45060.md) | Nov 9, 2022 | Debian 13.5 (trixie) 7.1.1-1.1 | High | 1 | 0 |
| [varnish 5.2.1-1ubuntu0.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-varnish-5.2.1-1ubuntu0.1-esm1.md) | Nov 8, 2022 | Ubuntu 18.04.6 LTS (bionic) 5.2.1-1ubuntu0.1+esm1 | High | 1 | 0 |
| [varnish 6.2.1-2ubuntu0.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-varnish-6.2.1-2ubuntu0.2-esm1.md) | Nov 8, 2022 | Ubuntu 20.04 LTS (focal) 6.2.1-2ubuntu0.2+esm1 | High | 1 | 0 |
| [varnish 6.6.1-1ubuntu0.2+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-varnish-6.6.1-1ubuntu0.2-esm1.md) | Nov 8, 2022 | Ubuntu 22.04.1 LTS (jammy) 6.6.1-1ubuntu0.2+esm1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-38150](https://patchblox.com/security/data/fix/linux/debian-cve-2022-38150.md) | Aug 11, 2022 | Debian 12.15 (bookworm) 7.1.1-1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-38150](https://patchblox.com/security/data/fix/linux/debian-cve-2022-38150.md) | Aug 11, 2022 | Debian 13.5 (trixie) 7.1.1-1 | High | 1 | 0 |
| [DSA-5088-1](https://patchblox.com/security/data/fix/linux/dsa-5088-1.md) | Mar 3, 2022 | Debian 11.6 (bullseye) 6.5.1-1+deb11u2 | High | 1 | 0 |
| [ALSA-2022:0418](https://patchblox.com/security/data/fix/linux/alsa-2022-0418.md) | Feb 3, 2022 | almalinux 8 6.0.8-1.module_el8.5.0+2620+03a0c2cc.1 | High | 1 | 0 |
| [RLSA-2022:0418](https://patchblox.com/security/data/fix/linux/rlsa-2022-0418.md) | Feb 3, 2022 | rocky 8 0:6.0.8-1.module+el8.5.0+736+fec10e21.1 | High | 1 | 0 |
| [ELSA-2022-0418](https://patchblox.com/security/data/fix/linux/elsa-2022-0418.md) | Feb 3, 2022 | ol 8 0:6.0.8-1.module+el8.5.0+20491+1af4e193.1 | High | 1 | 0 |
| [RHSA-2022:0418](https://patchblox.com/security/data/fix/linux/rhsa-2022-0418.md) | Feb 3, 2022 | RHEL 8 0:6.0.8-1.module+el8.5.0+14089+03a0c2cc.1 | High | 1 | 0 |
| [DEBIAN-CVE-2022-23959](https://patchblox.com/security/data/fix/linux/debian-cve-2022-23959.md) | Jan 26, 2022 | Debian 12.15 (bookworm) 7.1.0-5 | High | 1 | 0 |
| [DEBIAN-CVE-2022-23959](https://patchblox.com/security/data/fix/linux/debian-cve-2022-23959.md) | Jan 26, 2022 | Debian 13.5 (trixie) 7.1.0-5 | High | 1 | 0 |
| [varnish 6.2.1-2ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-focal-varnish-6.2.1-2ubuntu0.1.md) | Jan 25, 2022 | Ubuntu 20.04 LTS (focal) 6.2.1-2ubuntu0.1 | High | 4 | 0 |
| [varnish 5.2.1-1ubuntu0.1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-varnish-5.2.1-1ubuntu0.1.md) | Jan 25, 2022 | Ubuntu 18.04.6 LTS (bionic) 5.2.1-1ubuntu0.1 | High | 2 | 0 |
| [varnish 6.6.1-1ubuntu0.2](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-varnish-6.6.1-1ubuntu0.2.md) | Jan 25, 2022 | Ubuntu 22.04.1 LTS (jammy) 6.6.1-1ubuntu0.2 | High | 1 | 0 |
| [ELSA-2021-2988](https://patchblox.com/security/data/fix/linux/elsa-2021-2988.md) | Aug 3, 2021 | ol 8 0:6.0.6-2.module+el8.4.0+20258+f99218b2.1 | High | 1 | 0 |
| [RHSA-2021:2988](https://patchblox.com/security/data/fix/linux/rhsa-2021-2988.md) | Aug 2, 2021 | RHEL 8 0:6.0.6-2.module+el8.4.0+11921+1a6539fc.1 | High | 1 | 0 |
| [ELSA-2020-4756](https://patchblox.com/security/data/fix/linux/elsa-2020-4756.md) | Nov 10, 2020 | ol 8 0:6.0.6-2.module+el8.3.0+7653+45014445 | High | 3 | 0 |
| [RHSA-2020:4756](https://patchblox.com/security/data/fix/linux/rhsa-2020-4756.md) | Nov 4, 2020 | RHEL 8 0:6.0.6-2.module+el8.3.0+6843+b3b42fcc | High | 3 | 0 |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.