News on Varnish Software Documentation

Varnish WAF 1.3.2

Thu, 01 Oct 2026 00:00:00 +0000

About the release

Varnish WAF 1.3.2 is a security and maintenance release. The headline change is an update of the vendored ModSecurity library to 3.0.17, which fixes a number of upstream security advisories, several of them WAF bypasses. The release also adds arm64 packages.

The notable changes are highlighted below. Please see the changelog for the complete list of changes.

Notable changes

ModSecurity updated to 3.0.17

The vendored ModSecurity library has been updated from 3.0.15 to 3.0.17. The upstream releases 3.0.16 and 3.0.17 address the following security advisories:

Security, observability, and state modules are now standard in Varnish Enterprise

Mon, 21 Sep 2026 00:00:01 +0000

With the release of Varnish Enterprise 6.0.18r5, vmod-ratelimit, vmod-cwt, varnish-otel, vmod-kv, and vmod-nodes are promoted to General Availability (GA) and included as standard Varnish Enterprise features. These modules previously required a separate Licensed Add-on license; they are now available in every Varnish Enterprise deployment without an add-on license or configuration change.

What’s included

Security and access control

vmod-ratelimit: cluster-wide rate limiting coordinated via an external NATS message broker, for PoP-level or global abuse mitigation. This is distinct from vmod-vsthrottle, which handles single-node rate limiting.
vmod-cwt: CBOR Web Token (CWT) validation at the edge, for Common Access Token (CAT) workflows, IoT, and binary-token authentication.

Edge compute, routing, and state

Varnish Enterprise 6.0.18r5

Mon, 21 Sep 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.18r5 is a feature and bug fix release.

With this release, the kv, ratelimit, otel, cwt and nodes VMODs become standard Varnish Enterprise features. They were previously distributed as separately licensed feature add-ons and are now available to all Varnish Enterprise users.

The release also introduces a new experimental payload data allocator, purpose-built for MSE4, which can be enabled by setting the yalloc_enable parameter. It aims at better memory density and faster reclaim of memory for large allocations, and is disabled by default. As the allocator is experimental, its parameter names may change in a future release. The parameter must be set on the varnishd command line:

Vinyl Cache / Varnish Cache VCL string methods workspace overflow

Wed, 16 Sep 2026 08:00:00 +0000

Overview

A workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.

This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart.

Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, ..etc).

Varnish Controller 7.6.0

Mon, 07 Sep 2026 00:00:00 +0000

All components require to be upgraded for this release.

Support for wildcard domains (e.g. *.example.com). Wildcards follow TLS (RFC 6125) semantics. They match exactly one label, and an exact domain always wins over a wildcard.
Rolling upgrades can now be paused, resumed and stepped manually.
Invalidations can be given an optional name.
Varnish Enterprise licenses can now be distributed to all agents through the controller (vcli license varnish add).
Secure filesystem permissions for controller-created files (files 0640, directories 0770 with setgid). Default for new installations. Components existing before the upgrade keep the legacy permissions (see the upgrade notes).
The UI server gains SSO login through the organization’s IDP, controller-managed TLS certificates (including ACME), and configuration broadcast from brainz over NATS. Several of its configuration flags were renamed or removed (see the upgrade notes).
Router health output now includes the endpoint score (vcli router health).
gRPC routing plugins now receive score, latitude and longitude for each endpoint.
The agent logs when it enters and leaves maintenance mode.
Fixed a panic in the traffic router when a gRPC plugin was reconfigured under traffic.
Fixed health probing of agents whose root VCL lacks the health check include, which are now probed per domain instead of being reported unhealthy.
Fixed deploys not always applying the latest VCLGroup, so domain changes could be missed.
Fixed configuration sync after a brainz restart or an agent or router transfer.
Fixed TLS certificate loading so one bad certificate no longer prevents the remaining certificates from loading. The failing certificate is quarantined and the error reported on the deployment.
Fixed agents to re-fetch their deployed VCLGroups if the agent base directory is wiped clean.
Agent and router names derived from the hostname are sanitized into valid names. Explicitly configured invalid names are rejected at startup.
Fixed the traffic router flooding DNS with repeated requests for unknown domains.
Fixed parsing of = characters in configuration file values.
Updated dependencies to address upstream security advisories.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.18r4

Mon, 24 Aug 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.18r4 is a bug fix release with no new features. It contains important stability and correctness fixes, and all users are encouraged to upgrade.

Notable fixes

Fixed a bug where vcl.discard could make the manager process exit if the child process failed to answer the CLI in time, leaving the cache stopped until manual intervention. The manager now reports the failure and restarts the child.

Varnish Otel 3.0.0

Tue, 11 Aug 2026 08:00:00 +0000

varnish-otel 3.0.0 is a breaking release. The exported log record body now always matches what varnishlog-json produces, byte for byte, instead of a re-marshaled struct — anything parsing the body as a fixed JSON shape should re-check it. Log records also no longer carry SpanId/TraceId/TraceFlags as string attributes; use the record’s own TraceID/SpanID/TraceFlags fields instead, which every exporter already sets natively.

Other changes:

SeverityNumber is now set on every exported log record (traffic and probe logs), so backends can filter and alert on severity.
Failed transactions (VSL error or 5xx response) now correctly set the OTel span Status to Error.
Transaction errors reported by varnishlog-json are no longer silently dropped — severity, span error status, and error.type/error.message attributes now populate correctly for failed transactions.
Prometheus metric families that collapse several raw counters onto one name no longer randomly drop the description on some scrapes.
Reduced CPU and memory overhead in metrics recording, attribute handling, and duration calculation.

References

varnish-otel changelog

Varnish Helm Chart 1.8.4

Mon, 13 Jul 2026 17:27:39 -0700

This is a patch release for the Varnish Helm Charts.

For varnish-enterprise:

Updated varnish-enterprise image to 6.0.18r3

Varnish Enterprise 6.0.18r3

Thu, 09 Jul 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.18r3 is a feature and bug fix release. It contains important bug fixes and stability improvements, and all users are encouraged to upgrade.

New features

Backend TLS improvements

Connections to backends using TLS are now reused without having to re-issue a full TLS handshake.

Memory Governor

The Memory Governor can now enter the overloaded state when the configured memory_target is exceeded and it is not able to remove objects to reduce memory usage. This can be observed in VCL to react and the strict_governor feature flag can be enabled to prevent further object creations.

Varnish Discovery 1.6.4

Thu, 02 Jul 2026 00:00:01 +0000

Added Scaleway support, see Scaleway usage examples

References

Varnish Discovery changelog

Varnish WAF 1.3.0

Wed, 01 Jul 2026 00:00:00 +0000

About the release

Varnish WAF 1.3.0 is a feature release focused on observability. It adds two new VCL methods – .detection_mode() and .log_matches() – that make it easier to stage and tune a rule set before switching it to blocking.

Please see the changelog for the complete list of changes.

Notable changes

Query the current detection mode

.detection_mode() returns the engine’s effective state for the transaction – "On", "DetectionOnly" or "Off" – accounting for any mid-transaction ctl:ruleEngine change. It returns "Off" when there is no transaction, so it is safe to call unconditionally.

Varnish Helm Chart 1.8.3

Wed, 10 Jun 2026 16:27:06 +0900

This is a patch release for the Varnish Helm Charts.

For varnish-enterprise:

Fix for crashloop in varnishncsa container

Varnish Otel 2.5.0

Tue, 09 Jun 2026 08:00:00 +0000

varnish-otel now supports using a Prometheus exporter via OTEL_METRICS_EXPORTER=prometheus. Metrics are exposed on an HTTP /metrics endpoint for Prometheus to scrape.

New environment variables:

OTEL_EXPORTER_PROMETHEUS_HOST: bind host for the /metrics endpoint, defaulting to localhost. When running in a container, set this to 0.0.0.0 to bind on all interfaces.
OTEL_EXPORTER_PROMETHEUS_PORT: bind port for the /metrics endpoint, defaulting to 9464.

Other changes:

MSE4_BOOK.<book_name>.c_ykey_iter_{10ms,100ms,1000ms,1000ms_up} are now translated into a single histogram metric varnish.mse4.book.ykey.duration_seconds.bucket with le attributes (0.01, 0.1, 1, +inf), eliminating the need for label_replace workarounds in dashboards.
Added build support for ubuntu:resolute (Ubuntu 26.04 LTS).
the new environment variable OTEL_VARNISH_DISABLE_LOGGERS can be set to true to preserve resource if logging data isn’t needed.
TraceID, SpanID, TraceFlags are now also exported as native top log attributes, instead of just as regular log attributes.

Important: TraceID, SpanID, TraceFlags as regular logs attributes are now deprecated and will be removed in the next major release.

Varnish Helm Chart 1.8.2

Mon, 08 Jun 2026 09:28:47 +0900

This is a patch release for the Varnish Helm Charts.

For varnish-enterprise:

Updated varnish-enterprise image to 6.0.18r2

See Varnish Helm Chart Changelog for a full changelog

Varnish Enterprise 6.0.18r2

Fri, 05 Jun 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.18r2 is a bug fix release with no new features. It reverts a single change from 6.0.18r1 that introduced a regression, and all users running 6.0.18r1 are encouraged to upgrade.

The 6.0.18r1 release reworked the lifetime handling of the VSM cluster used to track VSM clients (varnishstat, varnishlog, and friends). That change turned out to introduce a regression that can leave VSM clients in a crash loop. 6.0.18r2 reverts it; all other changes from 6.0.18r1 are retained. (VS issue #3252)

A note on how Varnish handles the HTTP/2 Bomb

Thu, 04 Jun 2026 00:00:01 +0000

News recently surfaced about a new HTTP/2 denial-of-service technique dubbed the “HTTP/2 Bomb”, reported to affect a number of HTTP/2 implementations including Envoy, Apache httpd, nginx, Microsoft IIS and Cloudflare Pingora.

Reference: https://github.com/califio/publications/tree/main/MADBugs/http2-bomb

We have studied the technique and concluded that Varnish is not affected.

The attack combines an HPACK “indexed-reference bomb”, where thousands of one-byte header references expand into a large amount of server memory, with a zero-sized flow-control window that pins that memory in place. Varnish is not vulnerable to the amplification that makes this effective. As with the HTTP/2 CONTINUATION flood reported in 2024, memory used while processing HPACK is limited to a fixed buffer size regardless of the incoming header set, and the number of header fields per request is strictly capped (http_max_hdr), so such a request is rejected before any significant memory is consumed.

Varnish Enterprise 6.0.18r1

Thu, 28 May 2026 00:00:00 +0000

Note: This release has been removed

Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. The 6.0.18r1 rework of the VSM cluster lifetime can leave VSM clients (varnishstat, varnishlog, etc.) in a crash loop. The offending change has been reverted in 6.0.18r2, which users on 6.0.18r1 should upgrade to. (VS issue #3252)

About the release

Varnish Enterprise 6.0.18r1 is a feature and bug fix release. The headline change is a new compound-expression purging API in vmod_ykey, which lets operators invalidate objects that match a boolean combination of keys in a single call. The release also adds TLS support for the vmod_ratelimit NATS connection and ships a batch of stability and operational fixes, including two HTTP/2 panics on the walk-away path, a use-after-free crash in VSM clients, and proper log rotation for varnishncsa and friends under systemd.

Varnish WAF 1.2.3

Tue, 26 May 2026 00:00:00 +0000

About the release

Varnish WAF 1.2.3 is a maintenance release. It fixes a worker reliability issue in the bundled SecLang parser that could be triggered by certain rule contents and, in sufficient volume, cause the worker to be silently reaped by the manager.

Please see the changelog for the complete list of changes.

References

Changelog with the complete list of changes.
Varnish WAF Documentation
Varnish WAF Installation

Varnish Discovery 1.6.3

Mon, 25 May 2026 00:00:01 +0000

Kubernetes authentication now re-reads the authentication token to avoid using a timed-out token
New Ubuntu Resolute (26.04) packages available for both arm64 and x86_64

References

Varnish Discovery changelog

Varnish Helm Chart 1.8.0

Thu, 21 May 2026 13:09:23 +0900

This is a minor release for the Varnish Helm Charts.

This release contains two major changes:

The biggest addition is the new server.vcl.routes feature, please read about it in our guide for using it.

The second is that the container entrypoint is no longer used to start varnish. This will not affect usage unless you are using custom images with custom entrypoint. If that is the case, please override the server.command variable to point at your custom entrypoint.

Varnish Cache HTTP/2 parsing deficiency

Wed, 20 May 2026 08:00:00 +0000

Overview

A deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass or possibly even information disclosure and manipulation.

The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default.

The vulnerability affects both open source Varnish Cache and Vinyl Cache. All recent versions of Varnish Enterprise are not affected by the vulnerability.

Varnish WAF 1.2.2

Wed, 20 May 2026 00:00:00 +0000

About the release

Varnish WAF 1.2.2 is a maintenance release. The headline change is an update of the vendored ModSecurity library to 3.0.15, which brings a number of upstream security and stability fixes. The release also expands the set of supported package platforms.

The notable changes are highlighted below. Please see the changelog for the complete list of changes.

Notable changes

ModSecurity updated to 3.0.15

The vendored ModSecurity library has been updated from 3.0.14 to 3.0.15. The most notable upstream security fix is for CVE-2026-42268, an unsigned integer underflow in the verify* operators.

Telegraf binary will be removed from container images

Mon, 18 May 2026 00:00:01 +0000

The current release of our Varnish container images is the last one that will ship with the telegraf binary included. Starting with the next release, telegraf will no longer be present in the images.

Affected container images:

quay.io/varnish-software/varnish-plus
quay.io/varnish-software/varnish-plus-waf

If you do not rely on the bundled telegraf binary, no action is required.

Why we are removing it

telegraf is a sizable binary that is only used by a fraction of our users and with fewer binaries in the image means fewer CVEs to track, fewer components that need patching.

Varnish Enterprise 6.0.17r4

Tue, 12 May 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.17r4 is a feature and bug fix release. The headline change is a rewrite of the MSE4 eviction (LRU) machinery to run lock-free, which significantly improves performance and tail latency for caches with high object churn. The release also adds new tuning knobs for MSE4 and expands vmod_tcp with backend-side TCP information logging.

The new features and notable changes are highlighted below. Please see the changelog for the complete list of changes.

Varnish Enterprise 6.0.17r3

Fri, 08 May 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.17r3 is a feature and bug fix release. It contains important bug fixes and stability improvements, and all users are encouraged to upgrade.

Note: Versions 6.0.17r1 and 6.0.17r2 were pulled before publication and never released. 6.0.17r3 is the first public 6.0.17 release and includes all of the changes that were prepared for the earlier iterations.

Key highlights of this release include follow-up visibility and defensive hardening related to VSV00018 (originally fixed in 6.0.16r12), expanded TLS capabilities (CRLs, per-certificate security levels, PROXY-on-TLS listeners), new .tls.* backend properties, and a number of new VMOD features and bug fixes across the stack.

Varnish Controller 7.5.1

Wed, 29 Apr 2026 00:00:00 +0000

This is a patch release; components can be upgraded individually, except for the router deployment fix which requires both brainz and the router to be upgraded together.

Added aarch64 (ARM) packages for Varnish Controller components.
Added Ubuntu 26.04 (Resolute Raccoon) packages for Varnish Controller components.
Fixed URL matching in the root VCL when the request includes a port, now includes a new variable baseURLNoPort.
Fixed router deployment bug that could clear domains when multiple VCLGroups with different domains used the same routing rules.
Fixed agent backups to include the common VCL directory so backups can be restored correctly.
Fixed a bug where unrelated commits in a shared git repository would trigger a redeploy of a VCLGroup.
Fixed vcli to fail properly when VCL compilation fails during deploy.
Fixed session login and impersonation issues when creating session tokens.
Removed the GET-method requirement on the JSON health check response (traffic_router_health.vcl), and reload the root VCL when the generated health check VCL changes.
Prevented creation of a new rolling upgrade for a VCLGroup that already has an active one.
Prevented adding an already-deployed domain to multiple VCLGroups on the same agent, and prevented removing all domains from a deployed VCLGroup.
Reduced memory usage of the system debug and monitoring endpoints.
Reduced database load with covering indexes and several optimizations.
Improved ACME DNS propagation checks with clearer error messages and more reliable lookups.
Security hardening across the API gateway and traffic router, covering request and server timeouts, internal cache bounds, and proxy header / TLS SNI / HTTP Host validation.
Version mismatches between components are now logged at WARN level for better operational visibility.
Updated dependencies (Lego, PGX) to address upstream security advisories.
UI: Added a Server Deployments view per VCLGroup with live status polling and per-server deployment status. The VCLGroup header and list now show a warning when only some matching servers have deployed the latest configuration.
UI: Read-only agents are now marked Unavailable in the VCLGroup matching-servers picker in the UI.
UI: The Deploy & Compile file list now shows an indicator when a deployed file version is older than the latest available version.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Broadcaster 1.6.4

Thu, 16 Apr 2026 00:00:01 +0000

Built with latest Go version
New arm packages available

See Broadcaster Changelog page for more details.

Workspace overflow in HTTP/1 lingering sessions

Tue, 14 Apr 2026 08:00:00 +0000

Overview

A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests.

This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, more differences created merge conflicts, like partial support for trailers in Varnish Enterprise.

Varnish Controller 7.5.0

Tue, 14 Apr 2026 00:00:00 +0000

All components require to be upgraded for this release.

Support for rolling upgrades of VCLGroups.
Router health probes now support a JSON response format, reducing the number of health checks needed.
Added a new Score routing rule and sub-decisions.
Support for agent maintenance file to mark agents as stop-routing or resume-routing.
Administrators can now impersonate organizations.
Support for tag-based compile, deploy and validate commands in vcli (e.g. vcli vg compile --validate tag=prod,sweden:all).
ACME DNS validation now retries until the DNS check passes.
Gzip compression for API and debug endpoints.
Added support for MFA.
Fixed CIDR IPv6 lookup issue.
Security fixes for non-numeric key IDs and timing enumeration.
VCL source removed from full controller gather to reduce output size.
VCLGroup git include files limit is now set to max 200.
Significant performance improvements for deployments, routing configuration and statistics.
Signficant reduction of database queries.
Updated internal NATS serialization layer and agent/router subject format.
Built with Go 1.26 and updated dependencies.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Otel 2.4.0

Mon, 13 Apr 2026 08:00:00 +0000

varnish-otel is now compatible with Varnish Cache >= 9.0.1. Note that tracing will still require vmod-otel, which is a Varnish Enterprise feature, but metrics and logging will work without extra configuration on the Varnish side.

Two new resource attributes are now automatically populated:

varnish.version: detected using varnishd -V at startup.
service.instance.id: see the new OTEL_VARNISH_INSTANCE_ID variable below.

New environment variables:

OTEL_VARNISH_INSTANCE_ID controls how service.instance.id is set:
- none: doesn’t set the attribute.
- uuid: generate a UUIDv4.
- hostname: reads the hostname.
- auto (default): use the hostname if not empty, otherwise, generate a UUIDv4.
OTEL_VARNISH_LOG_RECORD_FILTER allows to pass -x/-X/-i/-I arguments to varnishlog-json. This notably permits filtering sensitive headers that shouldn’t be logged.

Other changes:

Denial Of Service in shared VCL deployments

Thu, 09 Apr 2026 08:00:00 +0000

Overview

The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL).

This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments.

If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server.

Workspace overflow in HTTP/2 sessions

Thu, 09 Apr 2026 08:00:00 +0000

Overview

The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.

HTTP/1 absolute URL parsing deficiency

Wed, 01 Apr 2026 10:00:00 +0000

Overview

A deficiency in HTTP/1.1 request parsing can potentially be used for cache poisoning or authentication bypass, if the req.url VCL variable gets passed unchecked to a backend which accepts requests with absolute form URIs.

The potential attack surface of this issue is limited to “root” URLs with a path of / as in https://example.com/, but not https://example.com/whatever.

We recommend to upgrade to a version which is not affected or mitigate the issue in VCL, as detailed below.

Varnish Controller Helm Charts 1.7.7

Thu, 19 Mar 2026 12:00:00 +0900

This is a patch release for the Varnish Controller Helm Charts.

For varnish-controller:

Updated varnish-controller images to 7.4.1

varnish-controller-router:

Updated varnish-controller-router image to 7.4.1

See Varnish Helm Chart Changelog for a full changelog

Varnish Broadcaster 1.6.3

Mon, 16 Mar 2026 00:00:01 +0000

Binaries are now statically compiled
Built with Go 1.26

See Broadcaster Changelog page for more details.

Varnish Discovery 1.6.2

Mon, 16 Mar 2026 00:00:01 +0000

Binaries are now statically compiled
Built with Go 1.26

References

Varnish Discovery changelog

Varnish Controller 7.4.1

Fri, 13 Mar 2026 06:00:00 +0000

This release is only for the new feature keep-invalidations. Brainz, apigw, vcli and UI need to be updated for this release in order to get the keep-invalidation feature to work.

Invalidations can now be marked with keep so that they are kept and not automatically removed. They can then be re-executed at a later time. Kept invalidations needs to be manually removed.
Fixed a bug where the permission for purger tokens was missing in the UI.
New nats-server, version 2.12.5.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Helm Chart 1.7.7

Thu, 12 Mar 2026 15:00:00 +0900

This is a patch release for the Varnish Helm Charts.

For varnish-enterprise:

Updated varnish-enterprise image to 6.0.16r13

See Varnish Helm Chart Changelog for a full changelog

Varnish Controller 7.4.0

Tue, 10 Mar 2026 00:00:00 +0000

This is a minor release. It is most relevant for users using history-based routing, users who want to allow non-admin API tokens to trigger cache invalidation, or users experiencing incorrect error reporting on multi-domain invalidations.

Added skipHistoryUtil option to routing rules. When enabled, the router checks endpoint utilization before returning cached history endpoints, skipping fully utilized ones.
Added APIPurger template role and basicinvalidationrequest permission, allowing organization-level users to trigger basic cache invalidation without requiring system administrator privileges.
Fixed an issue where cache invalidation across multiple domains could fail due to empty responses being incorrectly counted as errors.
Built with Go 1.25.8.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.16r13

Fri, 06 Mar 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r13 is a feature and bug fix release. This release contains important bug fixes and stability improvements, and all users are encouraged to upgrade.

A major highlight of this release is that substantial work has been done to make Varnish run stable on aarch64 (ARM64) hardware. The ARM64 build has been promoted to General Availability (GA) status and is now part of our mainline repositories.

Varnish Helm Chart 1.7.6

Thu, 05 Mar 2026 14:00:00 +0900

This is a patch release for the Varnish Helm Charts.

For varnish-enterprise:

Updated varnish-enterprise image to 6.0.16r12

For varnish-controller:

Updated varnish-controller images to 7.3.3

varnish-controller-router:

Updated varnish-controller-router image to 7.3.3

See Varnish Helm Chart Changelog for a full changelog

Varnish Controller 7.3.4

Thu, 05 Mar 2026 00:00:00 +0000

This is a patch release and each component can be individually upgraded from previous release.

Improved router memory efficiency by caching and reusing internal resources.
Reduced PostgreSQL log (WAL) file growth when no statistics retention is configured.
Always use TCP to lookup CAA records for ACME certificates.
Fixed unnecessary deployment checks during auto-deploy that could result in empty deployments.
Improved API documentation by adding descriptions to enums in the Swagger documentation.
UI: Improved feedback when deploying git-managed VCLGroups with compilation errors.
Built with Go 1.25.7.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.16r12

Thu, 26 Feb 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r12 is a bug fix release addressing a regression introduced in the 6.0.16r11 release. It contains important bug fixes and stability improvements, and all users are encouraged to upgrade.

References

Changelog with the complete list of changes for both 6.0.16r11 and 6.0.16r12.
Varnish Enterprise Documentation
Varnish Enterprise Upgrade Notes

Varnish Enterprise 6.0.16r11

Fri, 20 Feb 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r11 is a feature and bug fix release. This release contains important bug fixes and stability improvements, and all users are encouraged to upgrade.

Key highlights include new image processing capabilities in vmod_image, granular client certificate verification for TLS, and performance optimizations for vmod_slicer.

The features and optimizations are highlighted below. Please see the changelog for the complete list of changes in this version and previous versions.

Varnish Controller 7.3.3

Mon, 16 Feb 2026 00:00:00 +0000

This is a patch release and each component can be individually upgraded from previous release.

Support for loading a custom VCL for all VCLGroup per agent (see Agent Configuration).
Support router maintenance TCP port and file (see Router Configuration).
New -git-tag flag for vcli to specify tag to use for deployment (can be used for deploy, compile and validate).
Set a default of 15 database connections if no other values were configured before. To go back to the previous default values, set VARNISH_CONTROLLER_DB_MAX_OPEN_CONN and VARNISH_CONTROLLER_DB_MAX_IDLE_CONN to 0.
Fixed a bug where large CAA DNS responses would not be parsed properly for ACME certificates.
Fixed a bug where EAB was required for ACME but not showing in the UI.
Added documentation to the VCLI on random agent for ACME requests.
Increased ACME logging for certificate renewal.
Fixed a memory leak in the traffic router when the history routing rule was used after a GRPC plugin. History is now cleared upon removal of the history rule from the routing rule set.
Add support to see the amount of objects purges with y-key and regular purges (see Invalidations).
Add support to auto-remove agents and routers in container / autoscaling setups (see Brainz configuration).
Fix Swagger documentation for certificates.
vcli agent ls -v now only lists 10 deployed VCLGroups per agent and indicates if there are more than 10 with a “..(n more entries)” suffix.
Built with Go 1.25.7.
Fixed a bug where selecting a custom date for a API token would lead to a unresponsive UI.
Added a missing permission in the UI for customsession.
Added a column for expiration date when listing all certificates in the UI.
Increase zoom level on the CDN map in the UI.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Helm Chart 1.7.5

Wed, 28 Jan 2026 17:00:00 +0900

This is a patch release for the Varnish Helm Chart.

For varnish-enterprise:

Change Varnish default listening port to 0.0.0.0
add missing extraEnvs to varnishncsa

See Varnish Helm Chart Changelog for a full changelog

Varnish Controller 7.3.2

Mon, 19 Jan 2026 00:00:00 +0000

Only brainz needs to be updated for this release.

Implement the follow of symlinks in Git and increase the amount of Git files from 25 to 40.
Add a new [neq] API operator that can be used to filter records.
Add more information in monitoring data to the _info records.
Add a new VCLI command to deploy only a few files that have been changed, without the need of specifying every file.
Built with Go 1.25.6.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Helm Chart 1.7.4

Fri, 16 Jan 2026 00:00:00 +0900

This is a patch release for the Varnish Helm Chart.

For varnish-enterprise:

Updated varnish-enterprise image to 6.0.16r10

See Varnish Helm Chart Changelog for a full changelog

Varnish Helm Chart 1.7.3

Thu, 15 Jan 2026 17:00:00 +0900

This is a patch release for the Varnish Helm Charts.

For varnish-enterprise:

Re-added support for openTelemetry

For varnish-controller

Added support for fetching geoip csv file from URL

For varnish-controller-router

Added support for fetching geoip.mmdb and asn.mmdb files from URLs

See Varnish Helm Chart Changelog for a full changelog

Varnish Enterprise 6.0.16r10

Wed, 14 Jan 2026 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r10 is a feature and bug fix release that focuses on improved observability and scalable certificate management.

This release contains important bug fixes and stability improvements, and all users are encouraged to upgrade.

Key highlights include a new mechanism in vmod_ykey for hierarchical cache invalidation, allowing you to easily purge entire URL structures. Network observability has also been significantly enhanced with vmod_tcp, which can now report detailed TCP metrics at the end of a transaction. On the operational side, TLS certificate loading has been optimized to handle large-scale deployments more efficiently.

Varnish Enterprise 6.0.16r9

Mon, 22 Dec 2025 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r9 is a feature release that introduces experimental support for next-generation token authentication.

This release positions Varnish to handle the new industry standards for content protection, ensuring your delivery infrastructure is ready for modern anti-piracy workflows and seamless interoperability in multi-CDN environments.

The new feature is highlighted below. For the complete list of changes, please see the Changelog.

New features

Experimental CWT and CAT support in vmod_cwt

A new VMOD, vmod_cwt, has been added to enable the parsing, verification, and validation of CBOR Web Tokens (CWT) and Common Access Tokens (CAT).

Varnish Helm Chart 1.7.2

Mon, 22 Dec 2025 00:00:00 +0900

This is a patch release for the Varnish Helm Chart.

For varnish-enterprise:

Added support for licenseSecret
Added support for externalTrafficPolicy
Updated varnish-enterprise image to 6.0.16r9

For varnish-controller

Updated varnish-controller images to 7.3.1

For varnish-controller-router

Updated varnish-controller-router image to 7.3.1

See Varnish Helm Chart Changelog for a full changelog

Varnish Controller 7.3.1

Thu, 18 Dec 2025 00:00:00 +0000

Only NATS, UI, and brainz need to be updated for this release.

Fix a PostgreSQL scalability issue when aggregating large Varnish statistics by explicitly selecting a more efficient SQL query plan.
UI: Fix a bug when logging in over unencrypted connections that resulted in a Forbidden - CSRF token not found in request error message.
Upgrade NATS to version 2.12.3, built with Go 1.25.5.
Test all FQDNs when probing CAA entries for ACME certificates.
Built with Go 1.25.5.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.16r8

Thu, 04 Dec 2025 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r8 is a bug fix release. All users are encouraged to upgrade, both to get the latest bug fixes and the rich set of features in the recent release.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
Varnish Enterprise Documentation
General upgrading notes

Varnish Controller 7.3.0

Wed, 03 Dec 2025 00:00:00 +0000

All components require to be upgraded for this release.

After installing this upgrade, make sure to start Brainz before the Router. More details are in the upgrade notes.

Fix potential transfer problems of transferring agents between organizations when running routers in grace mode.
Provide internal metrics under new endpoint /api/v1/internal-metrics.
Keep ownership when transferring an agent or router to another organization.
Statistics can now be pruned with vcli stats prune ... command and via the API with a DELETE /api/v1/stats.
In DNS traffic routing, reply with a NOERROR instead of a SERVFAIL if we do not have any records to respond in the DNS traffic router.
When filtering vcli results, the new accept-empty flag allows empty results without giving an error.
ACME certificate acquisition timeout is configurable with acme-timeout parameter.
Retry failed ACME certificate acquisitions after five minutes.
ACME CAA checks got more resilient regarding NXDOMAIN DNS responses.
Extended ACME related log messages.
The ACME DNS endpoint can now be looked up though vcli acme lookup-dns ... and via the API with a POST /api/v1/acme/dns-record.
Allow for schema-less base urls.
vcli can now read the password from the environment variable VARNISH_CONTROLLER_CLI_PASSWORD.
UI: Added support for ACME upstream validations (DNS only).
UI: Fixed a status alert bug related to the controller license.
UI: Fixed a bug related to disappearing routing rules in VCL Groups.
UI: Improved scaling of pop-ups on the CDN map when zooming.
UI: Improved the informational message for cluster.vcl in the editor.
UI: Added the ability to see which VCLGroups are attached to a domain in the UI. Previously, only certificates were shown, now the domain detail page includes a filtered list of connected VCLGroups.
UI: Added new feature in VCLgroups (Rollback) to display file names, versions, and descriptions for better visibility.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.16r7

Wed, 26 Nov 2025 00:00:00 +0000

About the release

Varnish Enterprise 6.0.16r7 is a feature and bug fix release that focuses on hardening security workflows and improving backend failure handling.

Key highlights include new vmod_s3 capabilities for verifying signed client requests and handling unsigned payloads, as well as more flexible TLS certificate loading. This release also introduces +rush_failure, a new mechanism to reduce latency during backend outages by waking up waiting lists faster.

The features and optimizations are highlighted below. For the complete list of changes, please see the Changelog.

Varnish Otel 2.1.0

Mon, 24 Nov 2025 08:00:00 +0000

This version focuses on finer logging, introducing new environment variables that will impact the internal use of varnishlog-json and varnishncsa.

Among others:

OTEL_VARNISH_DURATION_BUCKETS and OTEL_VARNISH_SIZE_BUCKETS define bucke sizes for histograms
OTEL_VARNISH_LOG_TOOL can be set to ncsa to reduce the log volume considerably (at the expense of missing information)
OTEL_VARNISH_LOG_QUERY allows to filter out logs before they are processed by varnish-otel

Check out the full varnish-otel changelog for more information.

References

varnish-otel changelog

Varnish Discovery 1.6.1

Fri, 07 Nov 2025 08:00:00 +0000

Bugfix release to correct a crash at startup introduced by 1.6.0.

References

Varnish Discovery changelog

Varnish Enterprise 6.0.16r6

Mon, 27 Oct 2025 00:00:00 +0000

About the release

This is a bug fix release.

Please see the changelog for the complete list of changes in this version and previous versions.

Astute readers may notice the absence of a 6.0.16r5 release. The reason is that a candidate build for 6.0.16r5 encountered an issue during QA and was therefore not published.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Helm Chart 1.7.0

Wed, 22 Oct 2025 16:00:00 +0000

This is a release for Varnish Helm Chart.

If you’re using the default internal postgresql for the Varnish Controller helm chart, you need to manually upgrade Postgresql before upgrading the helm chart.

Please read the changelog carefully for instructions before upgrading if you are not using an external postgresql service.

If you are using an external postgresql service, you would have set postgresql.enable to false in your values.yaml. In that case, you do not need to perform this manual upgrade, and you can upgrade the helm chart normally without the extra steps.

Varnish Enterprise 6.0.16r4

Fri, 03 Oct 2025 00:00:00 +0000

About the release

This is a bug fix release.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Controller 7.2.1

Wed, 01 Oct 2025 06:00:00 +0000

Only UI and cli need to be updated for this release.

UI and cli: Fix problem that upstream validation FQDN values can be accidentally deleted.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 7.2.0

Wed, 01 Oct 2025 00:00:00 +0000

All components need to be upgraded for this release.

ACME certificates with DNS validation can now fetch external validations for supporting multiple certificates.
Handle failing ACME ARI with sane defaults and retry.
Statistics cleanup cannot be blocked by statistics aggregation any longer.
Fix database update when doing IDP organization updates.
Updated unclear log messages for better readability.
UI: Fixed a bug where a VCLGroup deployed with a gitconfig would not show the deployed files when the main VCL was located in a subdirectory from the root.
UI: Now displaying attached external routes in a routing rule (if any), even when externalroute is not an active lookuporder.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Discovery 1.6.0

Mon, 29 Sep 2025 08:00:00 +0000

Maintenance release, including:

New supported distributions:
- debian:trixie
- centos:10
Retired distributions:
- ubuntu:xenial
- ubuntu:bionic
- ubuntu:focal
vac sub command has been removed
Go version updated to 1.25
Azure SDK module has been updated too

References

Varnish Discovery changelog

Varnish Enterprise 6.0.16r3

Thu, 18 Sep 2025 00:00:00 +0000

About the release

This is a bug fix release. Most notably, it brings a fix to a regression that was introduced in 6.0.16r2 that caused us to pull that release from publication.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Enterprise 6.0.16r2 has been removed

Tue, 16 Sep 2025 00:00:00 +0000

Release removed from the repository

The release of Varnish Enterprise version 6.0.16r2 has been removed from the package repository due to a regression discovered in the latest release.

This release introduced an optimization in the handling of bans, which is a method for doing cache invalidation in Varnish. While the optimization significantly reduces locking contention, it unfortunately introduced a regression that may in certain setups lead to a crash.

We advise against using 6.0.16r2 at this time. Users who have already installed this version should downgrade to 6.0.16r1.

Varnish Enterprise 6.0.16r2 (unavailable)

Thu, 11 Sep 2025 00:00:01 +0000

Note: This release has been removed.

Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. See this announcement for more information.

About the release

This is a feature release. Among the changes there is a rework of how waitinglists are implemented in order to avoid spurious wake-ups, and the ban subsystem has been optimized to reduce the cost of object creation and removal.

Varnish Controller 7.1.5

Thu, 11 Sep 2025 00:00:00 +0000

We recommend upgrading all components but they can be updated independently.

Build with Go 1.25
NATS-Server version 2.11.8
Support for 0.0.0.0/0 and ::/0 in CIDR routing decision.
Failing ACME renewals are not retried for an extended period of time.
Domain-maps and CIDR rule CSV files now supports variable number of fields.
Invalidations that has no domain and is not root deployed will now fail on create.
Extended debug information for ACME HTTP challenges.
Configurable timeout for ACME HTTP requests (configured in brainz).
Log warning instead of error when an invalidation has already been removed during monitoring.
Fix built-in root VCL to allow delivering ACME validation solutions for both routers and agents.
Minor API documentation fixes for deployment states.
ACME certificates are now possible to validate over HTTP via routed requests through the traffic router.
- Note: If a custom root.vcl is being used, it will require modifications to allow ACME HTTP challenges to be served.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.16r1

Thu, 11 Sep 2025 00:00:00 +0000

About the release

This is a bug fix release.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Helm Chart 1.6.5

Tue, 26 Aug 2025 16:00:00 +0900

This is a patch release for Varnish Helm Chart.

For varnish-enterprise:

Fix for powerdns.service.annotations
Make clustering easier
Updated varnish-enterprise images to 6.0.14r8

For varnish-controller:

Updated varnish-controller images to 6.6.7

For varnish-controller-router:

Updated varnish-controller-router image to 6.6.7

See Varnish Helm Chart Changelog for a full changelog.

Varnish Enterprise 6.0.15r1

Mon, 25 Aug 2025 00:00:00 +0000

About the release

This release contains a number of smaller features and closes several issues.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

HTTP/2 Made You Reset Attack

Wed, 13 Aug 2025 00:00:01 +0000

Overview

A denial of service attack can be performed on Varnish Cache and Varnish Enterprise servers that have the HTTP/2 protocol turned on. An attacker can create a large number of streams and immediately reset them without ever reaching the maximum number of concurrent streams allowed for the session, causing the Varnish server to consume unnecessary resources processing requests for which the response will not be delivered.

This attack is a variant of the HTTP/2 Rapid Reset Attack, which was handled upstream as VSV00013. The countermeasure put in place for VSV00013 was to implement a rate limit on the number of stream resets allowed before the session would be closed by the Varnish server. The new variant of the attack bypasses this rate limit by executing a benign protocol violation, causing the stream to be reset by the server rather than by the client. This would effectively bypass the rate limit, reopening the attack vector.

Varnish Controller 7.1.4

Tue, 12 Aug 2025 00:00:00 +0000

We recommend upgrading all components but they can be updated independently.

Build with Go 1.24.6
NATS-Server version 2.11.7
Improved transfer of agents and routers to avoid a race condition where agents/routers registered as new ones during transfer.
Fix eDNS subnet scopes for IPv6/IPv4, where the minimum mask was not applied correctly.
Expire for vcli when creating a custom token/session now supports date.
ACME contact can now be updated with empty contact information
Adds extra database debug information for system-debug
Adds extra debug information for communication with ACME certificate authorities

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Bug in OpenSSL 3.0.17 affecting Varnish Enterprise

Fri, 08 Aug 2025 00:00:01 +0000

Varnish Enterprise running on Debian Bookworm with openssl/3.0.17-1~deb12u1 installed is affected by a bug in this specific version of OpenSSL. The Docker images provided by Varnish Software are built on Debian Bookworm, and are therefore affected by this.

Update: As of 2025-08-10 a fixed OpenSSL package has been released in Debian Bookworm. The problem is now addressed by doing a regular package upgrade followed by a restart of Varnish.

Impact

The bug may cause a race condition, which manifests itself as a panic of the child process.

Varnish Controller 7.1.3

Mon, 07 Jul 2025 00:00:00 +0000

Only brainz require to be upgraded. Upgrade agents to get the root.vcl fix.

Deploylogs are now correctly removed when deleting a VCLGroup.
Tags are now included correctly for agents that are passed to gRPC plugins in the Traffic Router.
Improved root.vcl skipping toLower for domain matching (improves performance when many domains are deployed).

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.14r8

Tue, 01 Jul 2025 00:00:00 +0000

About the release

This release fixes a backward compatibility issue in varnishlog introduced in Varnish Enterprise 6.0.14r6.

Using log-consuming tools such as varnishlog or varnishncsa from 6.0.14r6 or 6.0.14r7 may result in incorrect log tags when reading logs generated by older Varnish versions.

As a result, logs produced by 6.0.14r6 and 6.0.14r7 must only be read by tools built for those specific releases.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Enterprise 6.0.14r7

Fri, 27 Jun 2025 00:00:02 +0000

About the release

This release corrects a packaging error introduced in version 6.0.14r6, where vmod_kvstore was mistakenly included in the wrong RPM package. As a result, users relying on vmod_kvstore may have experienced failures when attempting to restart Varnish following a package upgrade.

Users of Debian-based packages were not affected.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Controller 7.1.2

Wed, 25 Jun 2025 00:00:00 +0000

Only brainz and the UI require to be upgraded.

Fixed a bug where the configured NICs were not returned from the API.
Fixed a bug where the graphs in the UI dashboard stayed empty.
Fixed a bug for loading TLS 1.3 certificates into Varnish.
Fixed a bug where invalidations did not load domains correctly as an organization user.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Licensed Add-ons in Varnish Enterprise

Tue, 24 Jun 2025 00:00:01 +0000

With the release of Varnish Enterprise 6.0.14r6, we are streamlining access to Licensed Add-ons – advanced modules that extend Varnish beyond core Content Delivery use cases.

While Add-ons such as DeviceAtlas, Akamai Connector, and WAF have been available for some time in separate repositories, this release marks the first step in making certain Add-ons directly available as part of the Varnish Enterprise software packages, simplifying deployment and evaluation for customers with the appropriate licenses.

Varnish Enterprise 6.0.14r6

Thu, 19 Jun 2025 00:00:02 +0000

About the release

This is a feature release of Varnish Enterprise introducing new core features and several new VMODs, in addition to several improvements to existing functionality. Notable highlights include support for fully automated OCSP handling and a new extended functionality key-value storage vmod_kv.

Note that with this release, some add-ons have been added to the software packages, and will be included when upgrading Varnish Enterprise to the latest version. However, a software license is necessary to run the add-ons in production.

Varnish Enterprise 6.0.14r5

Thu, 19 Jun 2025 00:00:01 +0000

About the release

This is a bug fix release.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Enterprise 6.0.14r4

Fri, 13 Jun 2025 00:00:01 +0000

About the release

This release closes a handful of issues found after launching the redesigned HTTP/2 engine.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Controller 7.1.1

Thu, 05 Jun 2025 00:00:00 +0000

Only agents requires to be upgraded.

Fixes a bug where renewed certificates were not loaded into varnish.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 7.1.0

Wed, 04 Jun 2025 00:00:00 +0000

All components needs to be upgraded for this release.

Support for revocation of ACME TLS Certificates.
Normalization of NIC names in the agent.
Fixes a bug where negative values for Longitude/Latitude was not saved correctly.
Make it possible to remove deploylogs for undeployed VCLGroups.
Hide NATS password in configs.
Agent root.vcl is now using none case-sensitive domain matching.
Domain validation is now more strict and follows RFC 1035.
Support for Domain Maps for CIDR:Tag routing.
Swagger documentation has been improved.
Support for eDNS subnet scopes.
- New configuration options for Routing Rules (ipv4MinMask and ipv6MinMask) to set the minimum mask for IPv4 and IPv6 addresses for router DNS responses.
Various bug fixes.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.14r3

Wed, 28 May 2025 00:00:01 +0000

About the release

This release brings a redesigned HTTP/2 engine for improved performance and stability. The new engine features fully asynchronous handling of frame input/output within its dedicated session thread. This resolves several long-standing stability issues that could lead to infrequent crashes when combining HTTP/2 with in-core TLS.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

HTTP/1 Request Smuggling Attack

Tue, 13 May 2025 10:00:00 +0000

Overview

A client-side desync vulnerability can be triggered in Varnish Cache and Varnish Enterprise. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 chunked requests.

An attacker can abuse a flaw in Varnish’s handling of chunked transfer encoding which allows certain malformed HTTP/1 requests to exploit improper framing of the message body to smuggle additional requests. Specifically, Varnish incorrectly permits CRLF to be skipped to delimit chunk boundaries.

Varnish Enterprise 6.0.13r16

Mon, 12 May 2025 00:00:01 +0000

About the release

This release brings a number of smaller features and some important bug fixes.

Some feature highlights:

When using the MSE4 stevedore, three new log messages are now generated. These messages provide information on the time spent preparing resources (like time spent freeing buffer memory and time spent waiting for I/O).
A selection of global parameters related to VCL transactions and thread pools are available as VCL variables.

Varnish Controller 6.6.11

Fri, 25 Apr 2025 00:00:03 +0000

Only the Controller UI needs to be upgraded in this release.

Adjustment of default behavior in the Controller-UI

This release contains an updated version of the Gorilla CSRF protection library with a fix to CVE-2025-24358. This fix makes it necessary to explicitly turn off checks of the HTTPS-specific Origin header if plaintext connections are used.

See the security settings for the Controller-UI examples for further details.

Necessary change for plaintext installations

Installations, that do NOT use TLS need to add the -no-tls flag to their UI server startup command.

Varnish Controller 7.0.1

Thu, 24 Apr 2025 00:00:00 +0000

We suggest upgrading all components with this patch release.

Adjustment of default behavior in the Controller-UI

See the security settings for the Controller-UI examples for further details.

Necessary change for plaintext installations

Installations, that do NOT use TLS need to add the -no-tls flag to their UI server startup command.

Varnish Controller 6.6.10

Mon, 14 Apr 2025 00:00:03 +0000

Fixed cleaning counter names for S3 and UDO statistics from IP addresses
Upgrade dependency “golang-jwt” to resolve CVE

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.13r15

Mon, 14 Apr 2025 00:00:01 +0000

About the release

This release fixes a single bug which has eluded us for a long while.

Bug fixed:

Configurations using HTTP/2 with TLS were subject to a race condition that could produce corrupted logs leading to panics in log consumers like varnishncsa.

Please see the changelog for the complete list of changes in this version and previous versions.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Enterprise 6.0.13r14

Wed, 09 Apr 2025 00:00:01 +0000

About the release

This release brings a number of smaller features and improvements.

Some highlights:

Optimized Ykey performance: We’ve introduced multiple trees for ephemeral objects, optimizing performance.
Revamped VHA6 limits framework: The Varnish High Availability limits framework has been updated, where the previous max_requests_sec setting is replaced by more granular controls broadcast_limit, broadcast_rate_limit and request_rate_limit.

The max_requests_sec setting used to contend with non-VHA usage of vmod_http. This may result in higher VHA6 activity for setups already operating at full broadcast capacity.

Varnish Controller 6.6.9

Tue, 08 Apr 2025 00:00:03 +0000

This release only affects the Brainz component.

Allow to stop aggregation queries from running when using the -keep-stats-* configurations.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 7.0.0

Thu, 27 Mar 2025 00:00:03 +0000

This is a major release, all components requires upgrade.

This release comes with a lot of breaking changes due to major changes to the deployment and file handling. Please see upgrade notes to see important changes. As a result of these major changes, the documentation has been divided into its own section for Version 7. This is to make it easier and to avoid no longer supported commands and examples.

Varnish Enterprise vulnerability in MSE4 when handling range requests

Tue, 18 Mar 2025 10:00:01 +0000

Overview

When using the MSE4 cache storage engine (stevedore) in versions prior to 6.0.13r13, a buffer overflow vulnerability can be triggered in Varnish Enterprise. The vulnerability can be triggered when handling range requests on ephemeral (non-persisted) objects stored in the MSE4 stevedore, and may cause arbitrary data from the Varnish Enterprise server memory address space to be sent as response bytes to incoming client requests.

The vulnerability is caused by an incorrect buffer boundary calculation when handling range requests for starting byte offsets that happen to be in the middle of a buffer. A set of bytes (with length limited to the buffer size) from addresses after the object buffer may then be sent as regular response bytes to the request.

HTTP/1 client-side desync vulnerability

Tue, 18 Mar 2025 10:00:00 +0000

Overview

A client-side desync vulnerability can be triggered in Varnish Cache and Varnish Enterprise. This vulnerability can be triggered under specific circumstances involving malformed HTTP/1 requests.

Certain malformed HTTP/1 requests have been handled by issuing a 400 Bad Request response, and then allowing the connection to carry on with a subsequent request on that same connection. For the case where the initial malformed request contains a request body, the body is not properly processed and is instead treated as the basis for a subsequent request. This can result in the client receiving a response associated with the improperly embedded request as a response to a subsequent request.

Varnish Controller 6.6.8

Tue, 11 Mar 2025 00:00:03 +0000

Note: We suggest upgrading all components with this patch release.

Fixed a bug in the aggregation logic when handling big statistics amounts.
Improved performance for statistics with Prometheus format.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Container images updated to Debian bookworm

Tue, 11 Mar 2025 00:00:01 +0000

The latest versions of our container images are now based on Debian bookworm and continues to be updated daily with the latest OS updates.

Affected container images:

quay.io/varnish-software/varnish-plus
quay.io/varnish-software/varnish-plus-waf
quay.io/varnish-software/varnish-discovery
quay.io/varnish-software/varnish-broadcaster

Please note that it is only the latest version of each image and tag and (:latest) that are updated daily.

This means that if you want to run a non-latest version of Varnish, the base OS will not be kept up to date automatically. In order to keep the base OS up to date it is necessary to build the image locally like this:

Varnish Enterprise 6.0.13r13

Fri, 14 Feb 2025 00:00:01 +0000

About the release

This release reverts some of the bug fixes that went into the last two releases of Varnish Enterprise. The changes that are being reverted are related to the TLS layer, and those fixes are being removed because they were causing issues with timeout management and hanging connections.

The original reason for the changes to the TLS layer was to address a long standing issue related to TLS over HTTP/2 (tracked as VS issue #2027), which can cause occasional crashes and instability. While the cause of issue #2027 is well understood at this point in time, unfortunately the approaches to rectify it has caused unwanted side effects.

Varnish Controller 6.6.7

Wed, 12 Feb 2025 00:00:03 +0000

Note: Only router requires update with this patch release.

New Configuration Option. The concurrency parameter allows users to set the maximum number of concurrent connections on the router.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.13r11 and 6.0.13r12 have been removed

Wed, 12 Feb 2025 00:00:00 +0000

Release removed from the repository

The release of Varnish Enterprise version 6.0.13r11 and 6.0.13r12 have been removed from the package repository. This is due to a regression in the latest releases.

The issue that has been uncovered can lead to backend TLS backend traffic hanging, causing timeouts and delays in serving traffic. This can severely affect the Varnish Enterprise server throughput.

We do not recommend anyone to use the 6.0.13r11 or 6.0.13r12 versions at this time. Users that have installed these versions may want to upgrade to version 6.0.13r13 if they are experiencing issues.

Varnish Enterprise 6.0.13r12 (unavailable)

Mon, 10 Feb 2025 00:00:01 +0000

Note: This release has been removed

Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. See this announcement for more information.

About the release

This is a bug fix release with no new features. Most notably, it brings a fix to a regression that was introduced in 6.0.12r11 that caused us to pull that release from publication.

Varnish Broadcaster 1.6.2

Tue, 04 Feb 2025 00:00:01 +0000

This is a patch release.

Built with Go 1.23
Packages for Amazonlinux-2023

See Broadcaster Changelog page for more details.

Varnish Enterprise 6.0.13r11 (unavailable)

Wed, 29 Jan 2025 06:00:00 +0000

Note: This release has been removed

Due to a regression bug it is not recommended for anyone to run this release. The packages have been removed from the package repository. See this announcement for more information.

About the release

This release brings a brand new VMOD, a few improvements and some bug fixes.

The new VMOD asn lets you look up IP addresses to get ASN and country codes from TSV databases. In addition to the VMOD, a database downloaded from IPtoASN is needed.

Varnish Controller 6.6.6

Thu, 23 Jan 2025 00:00:03 +0000

Note: Only api-gw requires update with this patch release.

We summoned Prometheus 3.0 support back in 6.6.4, but it slipped the release. The devil’s in the details, fixed now! 😈
- Support for Prometheus 3.x (api-gw now uses content-type tex/plain for Prometheus calls)

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 6.6.5

Wed, 22 Jan 2025 00:00:03 +0000

Note: We recommend updating all components for this patch release, as they all include fixes. See: versioning.

Fixes a bug in router trace where the location would stripped from a / in http://.
Fixes a bug in the agent where the backup was not performed of deployed VCL during root(dedicated) deployments due to missing root.vcl.
Fixes a bug in brainz where a VCL was not deployed if the main VCL ID was changed.
Increased timeout to avoid timeout when fetching large sets of statistics for domains and via the stats endpoint.
Increased timeout for system debug requests.
Build with latest Go 1.23.5
Fixes a bug in the UI where you could not toggle between the deployed and draft version of a VCLGroup.
Fixes a bug in the UI dashboards where router-statistics would show incorrect values when sampling statistics by specifying routers.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 6.6.4

Tue, 14 Jan 2025 00:00:03 +0000

Note: We recommend updating all components for this patch release, as they all include fixes. See: versioning.

Support for Prometheus 3.x (api-gw now uses content-type tex/plain for Prometheus calls)
Fixes a bug in the Router when fetching debug information.
Brainz will now warn for expiring license on stdout 30 days before it expires (previous 10 days before).
Set From now shows correctly File for configuration that comes from file and was specified in the global scope of the configuration file.
Fixed a bug where UI log in would crash.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 6.6.3

Fri, 20 Dec 2024 11:00:03 +0000

Note: Only nats, router and api-gw requires upgrading for this patch release, see versioning.

Update nats-server due to CVE-2024-45337.
Update golang.org/x/net for API-GW and Traffic Router due to CVE-2024-45338.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.13r10

Fri, 20 Dec 2024 06:00:00 +0000

About the release

This release brings multiple new features and some bug fixes.

Most notably,

A new VCL subroutine vcl_connect which is invoked for HTTP CONNECT after a return (connect); from sub vcl_recv. Use of this new functionality must be explicitly enabled by setting param.set experimental +vcl_connect.
A new varnishlog-json utility has been added to produce JSON formatted logs. The JSON schema is subject to change in a future release.

Varnish Controller 6.6.2

Tue, 17 Dec 2024 00:00:03 +0000

Update the Golang crypto library due to CVE-2024-45337. While Varnish Controller does not use the affected part of this library, this ensures we build with the latest version.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 6.6.1

Mon, 09 Dec 2024 00:00:03 +0000

Note: Only brainz needs upgrading for this patch release, see versioning.

Fixed an issue where statistics queries would fail to retrieve data.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users running version 6.6.0

Varnish Enterprise 6.0.13r9

Thu, 28 Nov 2024 08:00:00 +0000

About the release

This is a small release which addresses a problem in our ESI solution that was introduced in the previous release.

The fix addresses a race condition that would in certain cases result in a “use-after-free”, which would manifest itself as an assertion error.

All users of ESI who already upgraded to 6.0.13r8 are strongly encouraged to upgrade.

References

Changelog with the complete list of changes.
General upgrading notes

Varnish Controller 6.6.0

Wed, 27 Nov 2024 00:00:03 +0000

Note: All components needs to be upgraded for this release, see versioning.

Support for Roles. This feature offers a structured approach to combining and managing permissions across multiple users.
Resolved an issue where removing a tag from an agent incorrectly returned a 500 Internal Server Error instead of the actual error reason.
Fixed an issue where the CLI override flag for configs displayed an incorrect long value.
Addressed a problem where statistics aggregation caused unnecessary growth in the WAL log.
Updated agent state changes in logs to display as text values for better clarity.
Removed the duration field from the router’s request-log.
Updated the basic invalidation lock acquisition error message to a debug-level log, providing clearer context and reducing unnecessary noise.
UI: Major overhaul which has lead to several improvements in workflows and a performance boost.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.13r8

Thu, 14 Nov 2024 08:00:00 +0000

About the release

This release introduces new features in vmod S3 and parallel ESI, and a significant performance and resource usage optimization in MSE4 when using ykey - among other things. Instances using a persistent cache with MSE4 will need to empty the cache as part of the upgrade process due to an update to the book and store format. More about this in the upgrade notes section.

The features and optimizations are highlighted below. For the complete list of changes, please see the Changelog.

Varnish Helm Chart 1.6.1

Wed, 06 Nov 2024 16:00:00 +0900

This is a patch release for Varnish Helm Chart.

For varnish-enterprise:

Added support for MSE4 for varnish-enterprise 6.0.13r7 image pulled after October 25, 2024
Updated varnish-enterprise image to 6.0.13r7
Updated varnish-controller-agent image to 6.5.0-6.0.13r7

For varnish-controller:

Updated varnish-controller images to 6.5.0

For varnish-controller-router:

Updated varnish-controller-router image to 6.5.0

See Varnish Helm Chart Changelog for a full changelog.

Varnish Controller 6.5.0

Mon, 28 Oct 2024 00:00:03 +0000

Note: All components needs to be upgraded for this release, see versioning.

Built with Go 1.23.2.
NATS-server updated to v2.10.22.
Support for Azure AD as IDP (Microsoft Entra)

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Enterprise 6.0.13r7

Mon, 14 Oct 2024 08:00:00 +0000

About the release

This release contains many new features and bug fixes.

In this release, cluster.vcl has been updated to version 2.1 with several improvements. The Changelog includes information on this.

Also added with this release is experimental support for HTTP CONNECT on the client side.

In addition to the above, we have too many new features to mention here. There is also a sizable list of bug fixes.

Important: All users of Varnish Enterprise upgrading from version 6.0.12r9 or lower are encouraged to test their VCL with this release before upgrading. If you encounter VCL compilation failures due to invalid VMOD usage, you will need to update your VCL before upgrading. If this VCL has never caused a problem for you before, it is likely that this VCL code was never reached.

Varnish Helm Chart 1.6.0

Tue, 08 Oct 2024 16:00:00 +0900

This is a patch release for Varnish Helm Chart.

For varnish-enterprise:

As this release migrated EmptyDir mount on /etc/varnish to /etc/varnish/shared, a manual migration may be required when upgrading from previous versions if the path is explicitly referenced in the values file. Please refer to the full changelogs for more details.

Added an option to automatically de-registering Varnish Enterprise from Varnish Controller upon rollout
Added an option to make Varnish Enterprise wait for connection draining for zero-downtime during rollout
Added an option to no longer use init container for initializing Varnish Controller Agent state directory
Added an option to configure autoscaling behavior
Changed VCL configuration behavior so that bundled VCL in Docker image is used when VCL is not configured

For varnish-controller:

Varnish Helm Chart 1.5.1

Mon, 23 Sep 2024 21:00:00 +0900

This is a patch release for Varnish Helm Chart.

For varnish-enterprise:

Updated varnish-enterprise image to 6.0.13r6
Updated varnish-controller-agent image to 6.4.1-6.0.13r6

For varnish-controller:

Updated varnish-controller images to 6.4.1

For varnish-controller-router:

Updated varnish-controller-router image to 6.4.1

See Varnish Helm Chart Changelog for more details.

Varnish Controller 6.4.1

Fri, 20 Sep 2024 00:00:03 +0000

This is a patch release for Varnish Controller with the following fixes:

Ability to configure HTTPS for IDP redirects on the varnish-controller-ui (-idp-https-redirect).
Fixes a bug that prevented comma-separated ID filtering for specific resources (domains, configsets, tagroutes).

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Controller 6.4.0

Tue, 17 Sep 2024 00:00:03 +0000

Note: All components needs to be upgraded for this release, see versioning.

Built with Go 1.23.1.
NATS-server updated to v2.10.20.
Shared deployments now have 2 new headers added to the request to see which VCLGroup name and Agent name the request came from.
- X-Agent-Name
- X-VCLGroup-Name
The agents now supports to gather statistics per domain. This has to be enabled manually and it will increase the size of the statistics depending on number of domains deployed.
- Enabled via -domain-stats
Changes to statistics sampling in the agents
- A new flag (-stats-filter) has been introduced to the agents, used to configure statistics with one flag, supporting wildcards.
- The new -stats-filter will now supersede the vclgroup-stats-filter, agent-stats-filter and accounting-stats-filter (which will be deprecated in the next major release).
- The new filter also supports filtering out accounting keys.
- The root VCL has been updated to support domain statistics.
BaseURL for agents and external routes in the router is now stripped from the trailing / to avoid getting location set with double slashes (//).
Fixes a migration bug where file labels where reset during upgrade from a version prior to 5.3.0.
Fixes a bug where file state where not updated correctly, causing VCLGroup deployment with --wait time out when no changes to a file had been made.
Fixes a bug in UI CDN map when changing default data.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.13r6

Mon, 26 Aug 2024 08:00:00 +0000

About the release

This release contains new features and bug fixes.

In this release, a new version of cluster.vcl is included. We have designed the new version such that upgrading should not significantly change existing setups, but bring new features and improvements.

However, we cannot foresee all ways customers have integrated with, and configured the cluster VCL logic, so it is important that you test the new version of cluster.vcl before you deploy to production, or at least review the changes to understand how the new version affects you.

Varnish Enterprise 6.0.13r5

Fri, 12 Jul 2024 01:00:00 +0000

About the release

This release contains new features and bug fixes. Most notable is the new VMOD called vmod_deviceatlas3, which supports the version 3.x of the DeviceAtlas API and database.

Varnish Helm Chart 1.5.0

Thu, 11 Jul 2024 19:17:00 +0900

This is a minor release for Varnish Helm Chart.

For all components:

Added global configuration for annotations, labels, podAnnotations, and podLabels

For varnish-enterprise:

Added configuration options for extraEnvs
Added configuration options for extraVolumeMounts in agent and varnishncsa containers
Added configuration options for varnish-controller-agent’s init container
Changed securityContext to also applies to init container in addition to workload containers
Updated varnish-enterprise to 6.0.13r4
Updated varnish-controller-agent to 6.3.2-6.0.13r4

For varnish-controller:

Changed extraEnvs so it can be set as a dict, an object, or a template string
Updated varnish-controller to 6.3.2

For varnish-controller-router:

Varnish Controller 6.3.2

Wed, 10 Jul 2024 00:00:03 +0000

This is a patch release for Varnish Controller with the following fixes:

Updated NATS to the latest version: 2.10.17.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Controller 6.3.1

Wed, 10 Jul 2024 00:00:02 +0000

This is a patch release for Varnish Controller with the following fixes:

Backups on agents will now only be taken if there are deployments. This will remove a previous warning message that wasn’t critical.
Version of varnish-controller-ui showed 0.0.0 in the 6.3.0 release, this has been fixed.
The UI now validates the IDP client secret less strict.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 6.3.0

Mon, 08 Jul 2024 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

Binaries built with Go 1.22.5.
This release includes the Basic Invalidation feature. This feature is exclusively API/CLI-based for integration purposes, designed for both heavy-duty and straightforward purging tasks. More information can be found here.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This release is intended for users interested in an integratable invalidation feature, ideal for simple and quick use cases. For more advanced invalidation configurations where API integration is not a concern, we recommend using the regular invalidation feature.

Massive Storage Engine 4 - General availability information

Thu, 20 Jun 2024 01:00:01 +0000

Introduction

Massive Storage Engine 4 (MSE4) is the fourth generation in the series and was made generally available earlier this month. MSE is a stevedore, which is the component in Varnish that manages how and where cached data are stored. MSE can be used for ephemeral caching (in DRAM, called “memory-only”) and persistent caching (typically in SSDs). It is shipped with Varnish Enterprise.

This post aims to share some information about the current status of MSE4 and plans for the first weeks and months of its general availability period.

Varnish Enterprise 6.0.13r4

Wed, 19 Jun 2024 01:00:00 +0000

About the release

This release contains only bug fixes to address issues found in the recently launched Massive Storage Engine 4 (MSE4).

Varnish Controller 6.2.0

Tue, 18 Jun 2024 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

Important

Previous versions of the Varnish Controller aggregated UDO dynamic backends and S3 VMOD statistics with the IP and port in the counter names. These old statistic names will be deleted upon upgrading to version 6.2.0. The Varnish Controller agent will normalize the counter names and remove the IP and port to get a better aggregation of your statistics. This could take some time with larger databases.

Varnish Enterprise 6.0.13r3

Fri, 14 Jun 2024 01:00:00 +0000

About the release

This release contains mostly bug fixes to address issues found in the recently launched Massive Storage Engine 4 (MSE4).

Varnish Enterprise 6.0.13r2

Mon, 10 Jun 2024 01:00:00 +0000

Important update

Please note that there is a known issue with MSE 4 in this release. This is described on our Known Issues page.

About the release

This release introduces Massive Storage Engine 4 (MSE4), a few minor features and some bug fixes. Please see the Changelog for more information.

For easy transition between MSE3 and MSE4, Varnish Enterprise will contain both versions going forward. Environments using MSE3 will continue to use MSE3 after upgrading to 6.0.13r2, given that the configuration remains unchanged. The varnishd command line parameter -s is used to select which version to use.

Varnish Broadcaster 1.6.1

Mon, 10 Jun 2024 00:00:01 +0000

This is a patch release.

Built with Go 1.22.4
Packages for Ubuntu 24.04 (Noble)
Packages for Debian 12 (Bookworm)
Packages for Alma 9.0

See Broadcaster Changelog page for more details.

Varnish Helm Chart 1.4.0

Thu, 30 May 2024 16:58:00 +0900

This is a minor release for varnish-enterprise with the following changes:

Added configuration options to set base URL for Varnish Controller
Added configuration options to set Kubernetes load balancer IP
Fixed ingress service port when headless ClusterIP is used
Updated varnish-enterprise to 6.0.13r1
Updated varnish-controller-agent to 6.1.2-6.0.13r1

For varnish-controller, the following changes:

Updated varnish-controller to 6.1.2

Additionally, this release also contains a preview release of Varnish Controller Router Helm Chart.

Varnish Controller 6.1.3

Wed, 29 May 2024 00:00:02 +0000

This is a patch release for Varnish Controller with the following fixes:

Packages for Ubuntu 24.04 (Noble Numbat)
Use VCLGroup directory first when loading a VCL, instead of system defaults.
- Some VCLs are shipped with Varnish (e.g. cluster.vcl). If a VCL included cluster.vcl it would use the Varnish provided VCL. With this release, if a file is included in a VCLGroup and named cluster.vcl, the included VCL will be used instead.
Fixes a bug where vcl_path and vmod_path was generated with wrong defaults for cmds.cli on RedHat based distributions, when Varnish could not be reached.
Database performance improvements.
Fixed a bug in the editor where the file name in the tabs wouldn’t update as expected when renaming a file.

Components required for upgrade:

Varnish Controller 6.1.2

Mon, 20 May 2024 00:00:02 +0000

If certificates are used within the controller, the controller must be updated before updating varnish to version 6.0.13 or above.

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug where the TLS version check failed for Varnish versions 6.0.13 and above.
Binaries built with Go 1.22.3.
Fixed a bug in the invalidation handling when both VCLGroup and domain are provided as input arguments for shared deployments, but the domain didn’t exist, this will be rejected immediately.
Fixed a bug in the invalidation handling that could cause a request to remain in a running state even after the execution TTL had expired.
Changed log level to debug(from warning) for row not found when querying elements in the database which doesn’t exist.
File draft is now included in system debug.

Components required for upgrade:

Varnish Controller 6.0.3

Mon, 20 May 2024 00:00:01 +0000

If certificates are used within the controller, the controller must be updated before updating varnish to version 6.0.13 or above.

This is a patch release for Varnish Controller with the following fix:

Fixed a bug where the TLS version check failed for Varnish versions 6.0.13 and above.

Components required for upgrade:

Agent

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.13r1

Wed, 15 May 2024 00:00:00 +0000

About the release

This release introduces a new VMOD feature, allowing VMOD developers to limit the set of VCL subroutines from where a VMOD function or method can be called.

This feature has been applied to all existing VMODs, meaning that starting from this release, VCL configurations that used to compile with no errors and where VMOD functions/methods were misused will no longer compile.

Important: All users of Varnish Enterprise are encouraged to test their VCL with this release before upgrading. If you encounter VCL compilation failures due to invalid VMOD usage, you will need to update your VCL before upgrading. If this VCL has never caused a problem for you before, it is likely that this VCL code was never reached.

Varnish Controller 6.1.1

Tue, 30 Apr 2024 00:00:01 +0000

Note: Only the agent and the UI are affected by this release, see versioning.

The release includes a few bug fixes.

Revert setting the TMPDIR environment variable for varnishtest to agent’s base-dir.
Show location of router traces in the UI.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Enterprise 6.0.12r9

Tue, 30 Apr 2024 00:00:00 +0000

About the release

This release contains multiple improvements, new features and bug fixes.

All users of Varnish Enterprise are encouraged to upgrade.

See Changelog for more details.

All users are encouraged to upgrade.

References

Varnish Controller 6.1.0

Mon, 29 Apr 2024 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

The release includes bug fixes, improvements and new functionality.

New VCLGroup feature: Keep On Failure, keep the previous VCLGroup deployed on an agent if the new deployment fails.
Support for compilation of files via vcli (see vcli file compile -h).
Router Trace now includes location that shows the full redirect location (with respect to redirect template).
Reload a VCLGroup on all agents or a specific agent.

Varnish Enterprise 6.0.12r8

Thu, 18 Apr 2024 00:00:00 +0000

About the release

This is a small release containing a single fix for an issue that could lead to an infrequent assert.

See Changelog for more details.

All users are encouraged to upgrade.

References

Varnish Helm Chart 1.3.0

Tue, 09 Apr 2024 16:22:00 +0900

This is a minor release for varnish-enterprise with the following changes:

Added configuration options to use external secrets for secrets and passwords
Fixed an issue where relocating HTTP or admin ports caused Varnish Controller Agent to fail
Fixed a listening address in Varnish and a proper report of Pod IP to Varnish Controller

And for varnish-controller, the following changes:

Added configuration options to use external secrets for secrets and passwords
Updated varnish-controller to 6.0.2

See Varnish Helm Chart Changelog for more details.

A note on how Varnish handles an HTTP/2 CONTINUATION flood

Thu, 04 Apr 2024 00:00:01 +0000

Today news surfaced about a new HTTP/2 vulnerability affecting a large number of HTTP/2 implementations.

References here:

This vulnerability has been under embargo until today. Varnish Sofware was notified and learned about this on 2024-03-26. We have done a thorough study of the vulnerability, and have come to the conclusion that Varnish is not affected.

Memory consumption in Varnish in processing HPACK is limited to a fixed buffer size, regardless of the size of the incoming header set. Thus Varnish is not at any risk of runaway memory consumption due to an arbitrarily large incoming header set.

Varnish Enterprise 6.0.12r7

Thu, 04 Apr 2024 00:00:00 +0000

About the release

This release brings multiple improvements, in particular for vmod-udo, a new VMOD in vmod-prng and a number of important bug fixes.

See Changelog for more details.

All users are encouraged to upgrade.

References

Varnish Controller 6.0.2

Wed, 13 Mar 2024 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Added ownerships to the Controller Gather.
Added caching for token validation to increase performance in the API-GW.
UI: Fixed a bug where selecting a domain in a VCLGroup would only show 20 domains.
UI: Add search field when selecting domains in VCLGroup.

See Varnish Controller Changelog for more details.

This update is recommended for all users.

Varnish Controller 6.0.1

Wed, 28 Feb 2024 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fix a migration issue that could affect Routing Rules cors_origin and cors_methods becoming lost during 6.0.0 upgrade.
Skip verification of BaseURL if no BaseURL certificate is used for the agent.
Log entries for transferring an agent/router is now created for generated private tokens.
Output from -generate-config was missing its configuration section, now added correctly again.
Fix VTC for compilation of VCLGroups, that could in some cases miss to validate paths to files used by vmods.
The agent/router were not syncing updated environment/argument values correctly on restart, this has now been fixed.
UI: Now we always show router permissions, regardless off there is a router license or not.
UI: Fixed a potential memory leak.
UI: Fixed a bug where certificate info details not updating after uploading a new certificate.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 6.0.0

Thu, 01 Feb 2024 00:00:01 +0000

This is a major release of Varnish Controller and all its components need to be updated. The release contains several non backward compatible changes. These changes are described in the upgrade chapter.

New Features

Support for TLS certificates in both agents and routers. (see Certificates)
Support for configuration of agent/routers via CLI/GUI/API (see Config/ConfigSet)
Transfer agents and routers to and from organizations as private
Drain traffic from agents for request routing
Support for IDP login via GUI
Custom response headers for request routing
Specify number of DNS replies for request routing
New flags for agents (backwards compatible with old flags):
- varnish-admin-host
- varnish-port
- varnish-invalidation-port
Tags routing now supports multiple subdecisions

Changes

Staging of VCLGroups has been removed
Permission system reworked and might require some updates of permissions for users/organizations.
vcli commands are now a bit more streamlined and the output has been polished.
All vcli inspect commands now return an array of objects.
Description of statistic counters added (CLI/GUI and a new API endpoint to retrieve them)
CIDR/ASN/Geolocation routes in vcli now uses flags without -to-tag (see deprecation).
Where data were previously displayed as a comma separated list in vcli is now instead displayed on separated rows to ease the overview.
Existing lookup-order with tags for routing rules will automatically be converted into tags:<id> and a new routing decision named tagroute will be created for the routing rule.
UI: Reworked how we list and add domains in VCLGroups.
UI: Permission view reworked and updated to make it easier for the user.

Bug Fixes

The router would sometimes subscribe multiple times to heartbeats from the same agents, this has been fixed.
Statistics JSON data has been lower cased to match other JSON data via the REST API.
UI: Fixed an issue regarding detecting includes when file was having duplicate files included.
UI: Fixed an issue regarding automatically addition of file type in detected includes.
UI: Fixed an issue when showing available servers in VCLGroup not updating correctly.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.12r6

Wed, 31 Jan 2024 00:00:00 +0000

About the release

This release contains multiple improvements, new features and bug fixes. Most notable is the implementation of a backend priority scheme in vmod_udo, and the introduction of support for JA3 TLS fingerprinting.

There are multiple important bug fixes. All users are encouraged to upgrade.

References

Varnish Enterprise 6.0.12r5

Thu, 07 Dec 2023 00:00:00 +0000

About the release

This release introduces CLI commands for handling TLS certificates. You can now load, discard and update certificates without restarting Varnish.

See Changelog for more details.

References

Varnish Enterprise 6.0.12r4

Wed, 29 Nov 2023 00:00:00 +0000

About the release

This release contains a few bug fixes and no new features. All users of Varnish Enterprise are encouraged to upgrade.

See Changelog for more details.

References

Varnish Enterprise 6.0.12r3

Fri, 17 Nov 2023 00:00:00 +0000

About the release

A mistake in the previous release introduced a race condition that could under certain conditions trigger an assert.

We apologize for this slipping through the cracks of our QA procedure. The 6.0.12r2 release has been pulled from our repositories and will no longer be available.

All users are encouraged to upgrade.

See Changelog for more details.

References

Varnish Enterprise 6.0.12r2

Thu, 16 Nov 2023 00:00:00 +0000

About the release

This release contains a couple bug fixes and one new feature.

All users of Varnish Enterprise are encouraged to upgrade.

See the changelog for a detailed description of the added mitigations.

References

Varnish Enterprise 6.0.12r1

Mon, 23 Oct 2023 00:00:00 +0000

About the release

This release adds mitigations for the recently uncovered CVE-2023-44487.

These mitigations address a denial of service attack where an attacker can rapidly create a large volume of HTTP/2 streams and immediately reset them, causing Varnish to consume unnecessary resources for processing requests where the response will not be delivered.

See the changelog for a detailed description of the added mitigations.

References

Varnish Controller 5.3.2

Fri, 20 Oct 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Improved router configuration reload
Automatic host lookup of unconfigured IPv4/IPv6 for agents in the router is now only performed if DNS routing is enabled.
If an agent is unable to load the root VCL, it will stay in failing state instead of flipping between running/failing.
All components built with Go 1.21.3
UI: Fixed a bug in dashboard where the donut chart would show “No data to show”.
UI: Fixed a bug where tooltips in dashboard wouldn’t overflow and the content would be cut off.
UI: Fixed a bug where a error message would falsely be shown in a widget in the dashboard.
UI: Fixed a bug where a individual widget is a gauge wouldn’t calculate per second.
UI: Fixed a bug where users connected to a organization had problem selecting tags in a VCLGroup.
UI: Improvements to what we show as available servers when changing between root and shared deployments.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.11r7

Wed, 27 Sep 2023 00:00:00 +0000

About the release

This release fixes a bug where timeout_reqbody was enabled by default.

See Changelog for the complete list of features and bug fixes in this release.

References

Varnish Enterprise 6.0.11r6

Thu, 21 Sep 2023 00:00:00 +0000

About the release

This release contains multiple new features. Most notably,

A new fault tolerance facility for MSE 3. This allows MSE to deal with device failure in a more graceful manner.
New commands socket.open, socket.close and socket.list for the CLI. They can be used to decide whether to accept or refuse new client traffic. When sockets are closed, ongoing requests are processed until they complete, but new requests are refused and connections are closed.

Varnish Controller 5.3.1

Mon, 18 Sep 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Resolved a bug in migration logic
Improved SQL query for inserting Varnish Statistics

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Controller 5.3.0

Tue, 12 Sep 2023 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

The release includes bug fixes and improvements.

The traffic router default systemd file now has a LimitNOFILE set to 200000. This is to support a large number of connections towards the router.
Improvements to file rollback functionality
Improved performance for database queries
Router logs for utilization of endpoints now includes the current utilization and the configured limit.
vcli now support --clear-health-headers for RoutingRules, to clear existing health-headers.
A new description endpoint added, to show counter descriptions (vcli with verbose (-v) now includes descriptions for statistics).
Prometheus statistics via the controller now includes router and domain.
Reject account locking of users own account.
UI: Introduced descriptions for counters used in dashboard widgets.
UI: Introduced a new view with account logs.
UI: Improvements to all logs for resources.
UI: Improvements to error handling dashboard widgets.
UI: Improvements to validation regarding ipv4 and ipv6.
UI: Improvements to draft/deployed switch in a VCLGroup.
UI: Improvements how we handle latency.
UI: Improvements on how we handle nested includes.
UI: Improvements when deploying a VCLGroup that has files shared with other VCLGroups.
UI: Fixed a bug in editor switching between draft and deployed.
UI: Fixed a bug in dashboard widget where tags would be removed when edited.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Base64 decoding vulnerability in vmod-digest

Thu, 17 Aug 2023 05:00:00 +0000

A base64 decoding vulnerability has been discovered in vmod-digest.

This problem was discovered by an external party and not reported responsibly to Varnish Software or the Varnish Cache project. Since we don’t know exactly how widespread the knowledge about this vulnerability is, we have acted as though it is public knowledge or at least easily available. This warranted a fast-tracked process between discovery and disclosure.

Impact

The potential outcome of the vulnerability can be both authentication bypass and information disclosure, however the exact attack surface will depend on the particular VCL configuration in use.

Varnish Enterprise 6.0.11r5

Mon, 14 Aug 2023 00:00:00 +0000

About the release

This release contains a couple of new features and a bug fix.

All users of Varnish Enterprise are encouraged to upgrade.

See Changelog for more details.

References

Hitch 1.8.0

Wed, 09 Aug 2023 15:00:00 +0200

About the release

This is a maintenance release with bug fixes and a few new features.

Have a look at the changelog for more details.

References

Varnish Enterprise 6.0.11r4

Wed, 12 Jul 2023 00:00:00 +0000

About the release

This release contains several new features, including backend connection queues for managing connections when max_connections is reached, support for ECDSA algorithms in vmod_jwt and enhanced backend probes with expect_close for servers that don’t honor Connection: close.

All users are encouraged to upgrade.

VRT update

The VRT version has been updated with this version of Varnish Enterprise, which means that

VMODs need to be recompiled for this version to work with this version. Only VMODs you have compiled yourself are subject to the statement above. Packaged VMODs will always follow the VRT version of varnishd.

Varnish Controller 5.2.3

Wed, 28 Jun 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Moving average has been added to avoid spiking values when the agent reports bandwidth utilization for varnish instances.
Fixed a bug where the agent did not report in the values for: temperature, busy and status to the controller for root deployed VCLGroups.
Fixed a bug in UI where “Related VCLGroups” wouldn’t show all the connected VCLGroups.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 5.2.2

Tue, 20 Jun 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

UI: Fixed a bug where certain includes wouldn’t be included in a VCLGroup.
UI: Fixed a bug where it wasn’t possible to reset the tag in Geolocation route.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Enterprise 6.0.11r3

Wed, 14 Jun 2023 00:00:00 +0000

About the release

This is a small release containing a few significant bug fixes in scoreboard task tracking, VMOD activedns, VMOD goto and the fast_304 feature. There are no new features.

All users are encouraged to upgrade.

See Changelog for more details.

References

Varnish Controller 5.2.1

Tue, 13 Jun 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

All components built with Go 1.20.5
Bug fix where organization user with only read access to agents/routers could assign/remove tags. Now write access to agent/routers is required to assign/remove tags.
Bug fix for deleting a domain that is in use, the API previously returned status code 503 Internal Server Error, now it will return 403 Bad Request.
Improved performance when using API filters.
Router health probes and invalidations now supports IPv6.
Updated default VCL templates:
- Default Root VCL file (shared deployments) now responds 404 Not Found for requests towards a domain that is not deployed on the Varnish server.
- Default temporary VCL that is used when nothing is deployed, now responds 404 Not Found to all requests.
- These VCL templates can be customized, see Agent - Default VCL and Agent - Default Root VCL
UI: Fixed a table bug when there was multiple pages and deleting a resource would redirect to first page.
UI: Improvements to table column filter.
UI: Fixed a bug when filtering on Varnish State Unknown wouldn’t work.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Enterprise 6.0.11r2

Thu, 01 Jun 2023 00:00:00 +0000

About the release

This release contains a few new features, most notably introducing VMOD s3. VMOD s3 introduces functionality for using Varnish as a caching proxy in front of S3, including acting as a dynamic backend director for S3 endpoints.

There are multiple important bug fixes. All users are encouraged to upgrade.

See Changelog for more details.

References

Varnish Controller 5.2.0

Thu, 25 May 2023 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

The release includes bug fixes and improvements.

All binaries built with Go 1.20.4
Various performance improvements to database calls.
Improved CIDR routing decision that resolves an issue where two CIDR matches resulted in unpredicted match.
Static tags for private agents/routers are now added to the owner organization.
- Note: This fix will produce duplicate tags with same name but new IDs, existing tags will still be used for existing deployments.
VCLI now lists Last Deployed timestamp for deployed VCLGroups.
Custom kvstore counters are now added correctly to the Varnish Controller statistics.
Make sure it’s not possible to delete a tag used in a routing decision rule.
System debug has been reworked to contain more information about the applied configuration for each component.
Fixed a bug that returned 200 OK when updating an organization with a new name or locked state as a regular user (it was not updated as it’s not allowed). Now 403 Forbidden is returned.
Compile errors has been extended to also include stderr.
Possibility to configure how often invalidation retries should be done.
Added possibility to delete a staged VCLGroup through the regular VCLGroup delete command.
Added possibility for organization users to stage a VCLGroup.
Fixed a bug where Staging ID could linger on the VCLGroup after the staged VCLGroup has been deleted.
Optimize requests and reduce unnecessary ones in the UI.
Overall improvements to the dashboard and custom equations in the UI.
Added new column Compile State in VCLGroup table to show last compile status in the UI.
Added a new column with Last Deployed time in VCLGroup table in the UI.
Improved how we handle missing permissions and the redirects in the UI.
Fix so the user can redploy a VCLGroup even if the VCLGroup is stuck in a compiling or deploying state in the UI.
Fixed a bug when compiling a VCL file under certain conditions couldn’t recognize the includes in the UI.
Other optimizations, improvements and bug fixes in the UI.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 5.1.4

Thu, 04 May 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixes a bug where the router would crash during health checks of external routes.

This is a regression introduced in release 5.1.2. Releases prior to 5.1.2 are not affected.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes.

Varnish Controller 5.1.3

Fri, 21 Apr 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug where removing a RoutingRules from a VCLGroup would remove the RoutingRules from all VCLGroups that used the same RoutingRules.
Added support for mixed-casing DNS responses in the Router to support Google’s mixed-casing domain lookups.
Build with Go 1.20.3.
Fixed an error that appeared when content retrieval to a non existing path was requested through the UI-server.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 5.1.2

Wed, 22 Mar 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug in the Request Router where random was redirected to an unhealthy endpoint.
Improved database indexes for faster queries.
Headers set for health probes in the Routing Rules are now sent in the same casing as configured.
Build with Go 1.20.2.
vcli file now has -label support.
Error log level when MMDB CSV file is not configured has been lowered to Info.
Include gRPC Health and Routing Health information in router debug and system debug information.
Fixed an error in Invalidations where you couldn’t add new headers to existing invalidation.
Fixed a bug when having multiple includes with same name when creating/editing VCLGroups.
Fixed a bug involving renaming files in editor.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Cache Plus is now Varnish Enterprise

Tue, 14 Mar 2023 00:00:01 +0000

Executive summary

What

From today, future releases of Varnish Cache Plus will be called Varnish Enterprise in release notes, changelog and documentation.

Why

This change brings Varnish documentation up to date with the current naming convention of the commercial version of Varnish.

How

This change is fully backwards compatible and no action needs to be taken in existing environments.

Details

The change is fully backwards compatible and no action needs to be taken since it doesn’t affect how Varnish is installed, configured or managed.

Varnish Cache Plus 6.0.11r1

Fri, 10 Mar 2023 14:00:00 +0000

About the release

This release contains some new features and some bug fixes.

The new features include new counters, improved TLS support in varnishtest and improvements in VMODs rewrite and http.

All users of Varnish Enterprise are encouraged to upgrade.

See the changelog for the list of changes in this release.

References

Varnish Controller 5.1.1

Mon, 27 Feb 2023 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

UI: Fixed a bug where Tokens wouldn’t show in the menu for org-users.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes.

This update is recommended for all users.

Varnish Controller 5.1.0

Thu, 23 Feb 2023 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

The release includes bug fixes, new features and improvements.

New Features

Support for custom headers in router health checks.
Support for CNAME for external routes.
External routes location template support (for custom location format).
getent used as fallback to get uid/gid for components running as a user/group (to support IDM).
Flatbuffer schema for gRPC plugin now includes tags for endpoints and support for rejection decision.
Support for reject decision routes in the router.
Support for regexp routing decision.
X-Routed-For header for routed requests in a shared Varnish instance.
DebugHeader for RoutingRules, to only show debug information if a configured header is present.
UI: There is now a way to send varnishadm command to varnish servers.
UI: Now using Gzip or Brotli for compression.
UI: Updated the visual appearance of the graphs.

Improvements

Fixes an issue with varnish_stat_id_seq max ID error in the database.
Bug fixes for monitoring of agents during invalidation.
Improvements to deployment of VCLGroups.
Configuration file for the VCLI now have a stricter permission policy.
UTC used for the database to avoid time zone issues.
Router now reports correct NS records for private routers.
Request logging (to stdout) in the router now logs failed requests as well.
Fixes a bug where login via API required content-type application/json.
Validation added for two or more VCLGroups with same domain cannot use different RoutingRules.
Validation added to verify that healthcheck window-size and threshold must be larger than 0.
Various updates to VCLI help outputs.
TTL for NS records is now correct for the Request Router.
All components build with Go 1.20.
UI: Can now handle larger datasets more efficiently in CIDR and ASN routing decisions.
UI: Fixed a bug in editor related to comments and includes.
UI: Fixed a issue with CSRF token.
UI: Various bug fixes and improvements to the dashboard.
UI: Fixed an issue where large VCLs could get a timeout during the compilation stage.
UI: Improved filter and search in data tables.
UI: Improved a11y.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Discovery 1.5.0

Fri, 10 Feb 2023 08:00:00 +0000

Maintenance release, including:\

Azure SDK minor version upgrade.
AWS SDK major version upgrade from v1 to v2.
Go 1.20.0

References

Varnish Discovery changelog

Varnish Cache Plus 6.0.10r5

Wed, 25 Jan 2023 10:00:00 +0000

About the release

This release contains many bug fixes and minor features.

All users of Varnish Enterprise are encouraged to upgrade.

See the changelog for the list of changes in this release.

References

Varnish Administration Console - End of Life notice

Mon, 02 Jan 2023 01:00:01 +0000

End-of-life

Varnish Administration Console (VAC) has reached end-of-life status. This means that we will no longer be providing updates, bug fixes, or technical support for the product.

With the end-of-life status of VAC, it is important to transition to the Varnish Controller, which has replaced the VAC and has all its features and much more.

Continuing to use Varnish Administration Console past its end-of-life date may present several risks, including:

Security vulnerabilities: As the product is no longer receiving updates, it may become vulnerable to security threats.
Compatibility issues: Varnish Administration Console may not be compatible with newer versions of Varnish Enterprise.
Limited support: As we are no longer providing support for the product, you may have difficulty obtaining assistance if you encounter any issues.

We recommend transitioning to the Varnish Controller as soon as possible in order to mitigate these risks. If you have any questions or concerns about this process, please do not hesitate to contact us.

Container images updated to Debian bullseye

Mon, 02 Jan 2023 00:00:01 +0000

The latest versions of our container images are now based on Debian bullseye and will from now on be updated daily with the latest OS updates.

Affected container images:

quay.io/varnish-software/varnish-plus
quay.io/varnish-software/varnish-plus-waf
quay.io/varnish-software/varnish-discovery
quay.io/varnish-software/varnish-broadcaster
quay.io/varnish-software/varnish-controller-agent
quay.io/varnish-software/varnish-controller-brainz
quay.io/varnish-software/varnish-controller-nats
quay.io/varnish-software/varnish-controller-router
quay.io/varnish-software/varnish-controller-ui
quay.io/varnish-software/varnish-controller-cli

A new tagging scheme has also been implemented:

For Varnish Enterprise: varnish-plus:6.0.10r1

quay.io/varnish-software/varnish-plus:latest
quay.io/varnish-software/varnish-plus:6.0.10r1
quay.io/varnish-software/varnish-plus:6.0.10
quay.io/varnish-software/varnish-plus:6.0
quay.io/varnish-software/varnish-plus:6

Varnish Controller Agent is bit special as it is based on a Varnish Plus image and versioned with the Varnish Plus version.

Varnish Cache Plus 6.0.10r4

Wed, 30 Nov 2022 10:00:00 +0000

About the release

This release contains many bug fixes and minor features. As an example, there are many updates to the Slicer feature.

All users of Varnish Enterprise are encouraged to upgrade.

See the changelog for the list of changes in this release.

References

Varnish HTTP/2 Request Forgery

Tue, 08 Nov 2022 08:01:00 +0000

A request forgery attack can be performed on Varnish Cache and Varnish Cache Plus servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server.

Open Source Varnish Request Smuggling

Tue, 08 Nov 2022 08:00:00 +0000

Note: This issue applies only to the open source version of Varnish Cache, in version 7.0.x, 7.1.x and 7.2.x. Varnish Enterprise is not affected. For more information please see the open source project’s advisory page.

A request smuggling attack can be performed on Varnish Cache servers by requesting that certain headers are made hop-by-hop, preventing the Varnish Cache servers from forwarding critical headers to the backend. Among the headers that can be filtered this way are both Content-Length and Host, making it possible for an attacker to both break the HTTP/1 protocol framing, and bypass request to host routing in VCL.

Varnish Controller 5.0.2

Tue, 08 Nov 2022 00:00:01 +0000

This is a patch release of Varnish Controller.

This release includes bug fixes and minor improvements.

The router now strips port from requested domain, to allow the router to run on none default ports.
Improved logging for Varnish-admin interface (the agent now logs connection/disconnection towards Varnish)
Improved logging for NATS connection/disconnection for api-gw/brainz/agent/router.
Improved error logging for the VCLI.
NATS updated to latest version, v2.9.6.
All components built with Go 1.19.3

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Controller 5.0.1

Tue, 25 Oct 2022 00:00:01 +0000

This is a patch release of Varnish Controller.

This release includes bug fixes.

Fixes a bug where Brainz could panic when routers is used.
Fixes a bug where invalidations got stuck for a removed VCLGroup.
Fixes a bug where invalidations could get stuck in Retrying state.
Fixes a bug where invalidations in Retrying state could not be deleted.
Updated dependencies
Fixes a bug where domains always was shown as required when creating/editing a VCLGroup in the web interface.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Broadcaster 1.6.0

Tue, 18 Oct 2022 00:00:01 +0000

This is a minor release. It includes bug fixes, improvements and some new features.

Built with Go 1.19.2
New API endpoint /api/status/count (see API documentation)
New flag to configure the job purger (-job-purger <duration>) for removing finished async job requests.

See Broadcaster Changelog page for more details.

Varnish Controller 5.0.0

Tue, 18 Oct 2022 00:00:01 +0000

This release requires Varnish Enterprise 6.0.9r5 or later.

This release includes bug fixes, new features and several improvements.

New Features

Private Agents that can be shared between organizations.
Private Routers that can be shared between organizations.
Support for adding custom Accounting keys to save custom statistics (agent configuration).
Agents now support TLS for invalidation towards Varnish
Auth support for 3rd party utilities such as Prometheus via the API call /auth/oauth/token.
Varnishstat counters that has VCL name, is now stripped from VCL SHA and saved to the database (e.g. KVSTORE.kvs.vg11_a5a171b5259910e174afed5d6fea23ac146f333a9dc9d7b183447c3fc687a578_1.mycounter is now stored as KVSTORE.kvs.vg11.mycounter).
vcli whoami to show the current logged in user in the CLI.
Support for ASN based routing with the traffic router.
Support for CIDR based routing with the traffic router.
Support for Geolocation based routing with the traffic router.
Overhauled UI and workflow.
Darkmode for UI.
CDN map.

Improvements

System Debug information now includes configuration from the database for easier debugging.
Routers now randomize selection of endpoints for external routes that have the same weight.
Improved logging of Varnishadm errors
Agents now use their base-dir as a temporary directory to avoid using system tmp in case this is readonly.
VCLGroups now have DeployState instead of Deployed which can be Deploying, Deployed or Undeployed.
Components now register themselves with names towards NATS for easier debugging.
VMOD HeaderPlus is now used for handling routing in the root VCL for shared deployments. User VCLs do no longer have to handle host/url parsing for routed (redirected) requests.
Router/Agents now supports multiple IPv4/IPv6 configuration and DNS routing now supports multiple A/AAAA records.
vcli vclgroups state added to show state of all agents for a VCLGroup (also shows potential errors for deployments in varnish)
A generated VTC (Varnish Test) is now used for validation of VCLs on agents that also finds potential issues with use of files that don’t exist.
All components built with Go 1.19.2.
Nats-server updated to 2.8.4.
Various improvements to the dashboard including a fix for custom equation, timezone-offset bug, etc.

Breaking Changes

/vcls/ endpoint has been removed. /files/ is used for both VCL and other types of files.
vcli has been updated with multiple output changes to make all commands more alike in their output.
vcli inspect now always outputs an array, even for results with one object.
VCLGroup.Deployed removed and replaced with VCLGroup.DeployState
Several vcli commands have a bit different output format (see details in Changelog).
The /api/v1/agents/1/vclgroups endpoint has been removed, use /api/v1/vclgroups?agents.id=1&vg_states.deployed=true instead.
The /api/v1/tags/1/agents endpoint has been removed, use /api/v1/agents?tags.id=1 instead.
The /api/v1/vclgroups/1/agents endpoint has been removed, use /api/v1/agents?vcl_groups.id=1&vg_states.deployed=true instead.
The operator=and has been removed from the filters, instead of ?tags.id=1,2&operator=and use ?tags.id[all]=1,2.
Debug for agents/routers are now only available for system admins or owners of private agents/routers.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Cache Plus 6.0.10r3

Wed, 05 Oct 2022 07:00:00 +0000

About the release

This release is a bug fix release. All users of Varnish Enterprise are encouraged to upgrade.

See the changelog for the list of changes in this release.

References

Varnish Cache Plus 6.0.10r2

Wed, 17 Aug 2022 08:00:00 +0000

About the release

This release contains several bug fixes and a few minor features.

New in this release is support for prometheus format for vmod_kvstore counters in vmod_stat, improved parallel ESI scheduling and better tracing of ESI requests in varnishscoreboard.

See the changelog for the complete list of changes in this release.

References

Open Source Varnish Cache Denial of Service

Tue, 09 Aug 2022 08:00:00 +0000

Note: This issue applies only to the open source version of Varnish Cache, in version 7.0.x and 7.1.x. Varnish Enterprise is not affected. For more information please see the open source project’s advisory page.

A denial of service attack can be performed against Varnish Cache servers by specially formatting the reason phrase of the backend response status line. In order to execute an attack, the attacker would have to be able to influence the HTTP/1 responses that the Varnish Server receives from its configured backends. A successful attack would cause the Varnish Server to assert and automatically restart.

Varnish Cache Plus 6.0.10r1

Tue, 26 Jul 2022 10:00:00 +0000

About the release

This release contains both new features and several bug fixes.

New in this release are preview packages of Varnish Cache Plus for Ubuntu 22.04 LTS (Jammy Jellyfish). This marks the first step in making Ubuntu 22.04 a fully supported platform.

Other noteworthy changes are support for HTTP proxy tunneling in vmod_akamai, and new features in vmod_headerplus.

See the changelog for the complete list of changes in this release.

Varnish Discovery 1.4.0

Wed, 29 Jun 2022 10:00:00 +0000

Maintenance release, including AWS SDK version upgrade.

References

Varnish Discovery changelog

Varnish Controller 4.1.3

Mon, 27 Jun 2022 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug when upgrading to 4.X.X the internal file name column stayed empty, causing compilation failures.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes.

This update is recommended for all users.

Varnish Custom Statistics 6.2.2

Thu, 09 Jun 2022 00:00:00 +0000

About the release

This release is a bug fix release that fixes an issue where vcs-server would leak connections if a write failure occurred when using the -O option.

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish Controller 4.1.2

Wed, 01 Jun 2022 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug when upgrading to 4.0.0 the name of the file could be reset when deploying a VCLGroup.
Fixed a bug where renaming a file would result in a compile failure.
Minor UI bug fixes for the dashboard
Fixed a bug where the UI validation hindered the invalidation when only domain was sent in.
Fixed a autosuggestion with wrong formatting.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish Cache Plus 6.0.9r7

Fri, 20 May 2022 10:00:00 +0000

About the release

This release is a bug fix release to address a significant regression that first appeared in Varnish Cache Plus 6.0.9r5.

Also released is the Varnish Web Application Firewall (WAF) version 1.1.1, which requires VCP version 6.0.9r7 (this release) or newer. New in this version are functions to skip rules by either an ID or a tag.

From the changelog:

A problem has been found in the change introduced in version 6.0.9r5 labelled “Faster recycling of reusable backend connections during a fetch.”. The problem would result in a segmentation fault error while handling certain types of failed fetches. This change has been reverted. (VS issue #1436)

See the changelog for the complete list of changes in this release.

Varnish Controller 4.1.1

Tue, 17 May 2022 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug where a VCLGroup could stay in a compiled state.
Swagger docs compatible with Swagger 2.0
Minor router and UI bug fixes

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes.

This update is recommended for all users.

Varnish Cache Plus 6.0.9r6

Wed, 04 May 2022 13:00:00 +0000

About the release

This release contains only a few changes, of which one represents a significant reimplementation.

New features:

New version of vmod_http. The new version allows for better connection reuse, caching of hostname lookups, and gives better performance when many simultaneous requests are active. The new version is VCL compatible with the previous version, and no adjustments to VCL programs is necessary.

Note that this version will limit the protocols enabled in the underlying CURL execution engine to HTTP and HTTPS, and that HTTP/1.1 will be the preferred HTTP version. This can be changed by adjusting the corresponding Varnish runtime parameters (vmod_http_require_http and vmod_http_prefer_http_11).

Varnish Cache Plus 6.0.9r5

Thu, 28 Apr 2022 11:00:00 +0000

About the release

This release contains several bug fixes and some new features.

Note: The 6.0.9r5-1 packages released on 2022-04-28 contained a change to the way PID-files were handled in the package-included varnishd.service systemd service file. These changes caused upgrade issues on some systems depending on if and how the varnishd.service had local customizations. This was due to a missing -P %t/%N/varnishd.pid command line option in the options given to varnishd in the customized service files, causing varnishd to not produce the PID-file systemd was told to expect. The subsequent 6.0.9r5-2 packages released on 2022-04-29 have these service file changes reverted back to the state prior to this release.

Varnish Controller 4.1.0

Tue, 19 Apr 2022 00:00:01 +0000

Note: All components needs to be upgraded for this release, see versioning.

The release includes bug fixes, new features and improvements.

New Features

gRPC plugin support for the Router.
vcli now support proxy (-proxy).
Statistic counters can now be defined with wildcard in agent configuration.
New section for help & support which include a debugging view for system administrators (UI).

Improvements

Improved logging with support for timestamps (-log-timestamps), default enabled.
Unified router/agent log messages in brainz.
Various bug fixes.
Major redesign of the Editor (UI).
Less interruptive workflow when token expires with a login-modal (UI).

Important Note

The router has been updated to support both HTTPS and HTTP at the same time. This replaces the previous flag -http-tls with -https-routing and two new flags has been added for HTTPS, https-host and https-port.

Varnish Controller 3.0.4

Tue, 19 Apr 2022 00:00:00 +0000

The release includes a bug fix in the API-GW.

Bug fixes

Fixed a bug where some endpoints could return incorrect resources

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Take a look at the Varnish Controller Deprecation page to prepare for upcoming major changes.

This update is recommended for all users with version 3.0.3.

Varnish Broadcaster 1.5.3

Wed, 02 Mar 2022 00:00:01 +0000

Patch release, built using Go 1.17.

See Broadcaster Changelog page for more details.

Varnish Discovery 1.3.0

Thu, 24 Feb 2022 10:00:00 +0000

“Maintenance release, including dependency updates. No changes are required by the user”

References

Varnish Discovery changelog

Varnish Agent 6.2.7

Thu, 24 Feb 2022 00:30:01 +0000

About the release

This release includes possibility to enforce version 1.2 and above of TLS, as well as new a JSON endpoint for backends and bug fixes.

References

See varnish-agent changelog for more details.

Varnish Controller 4.0.0

Thu, 17 Feb 2022 00:00:01 +0000

This release is NOT backward compatible with 3.0. All Varnish Controller components requires an upgrade.

The release includes bug fixes, new features and improvements.

New Features

Varnish Controller (Traffic) Router, for HTTP and DNS routing.
VCL Compile feature for VCL Files added (UI).
Added drag and drop support in dashboard and invalidation sequence.
Varnishadm CLI commands file generated by the agents. The file contains varnishadm commands for current deployed Varnish VCL configuration. This file can be used to load the VCL’s directly on start of Varnish via the flag -I <file> to Varnishd.

Improvements

Widget creation improved (UI).
Automatic deployment retries to previously failed agents.

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

Varnish HTTP/1 Request Smuggling

Tue, 25 Jan 2022 10:00:00 +0000

A request smuggling attack can be performed on HTTP/1 connections on Varnish Cache and Varnish Enterprise servers. The smuggled request would be treated as an additional request by the Varnish server, go through normal VCL processing, and injected as a spurious response on the client connection.

This problem was discovered and reported to us by James Kettle, Director of Research at PortSwigger. We wish to thank him for the responsible disclosure.

Varnish Cache Plus 4.1.11r7

Fri, 21 Jan 2022 10:00:00 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r7.

About the release

This release is to reenable package building for Ubuntu Trusty.

See the change log for details on this and previous releases.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Cache Plus 4.1.11r6

Wed, 12 Jan 2022 10:00:00 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r6.

About the release

This release is a bug fix release and fixes issues with certificate verification on platforms using OpenSSL version 1.0, a request body timing issue as well as the update frequency for DNS updates in libvmod_goto. It is a recommended update for all users of Varnish Cache Plus 4.1.

Varnish Administration Console 3.9.3

Wed, 12 Jan 2022 01:00:01 +0000

About the release

This is a patch release that includes Log4j2 version 2.17.1, with fixes for CVE-2021-44832.

Varnish Administration Console is not vulnerable by default by CVE-2021-44832 as it requires specific configuration options that can be exploited. This release updates Log4j2 to the latest release to avoid keeping vulnerable versions of Log4j2 even if not affected by it by default.

This version is recommended for all users.

References

Varnish Cache Plus 6.0.9r4 and Web Application Firewall 1.1.0

Tue, 21 Dec 2021 08:00:00 +0000

About the release

This is a bug fix release which addresses some issues with vmod_accounting, and is is a recommended upgrade for all users of Varnish Cache Plus 6.0.x.

Also released is the Varnish Web Application Firewall (WAF) version 1.1.0, which requires VCP version 6.0.9r4. New in this version is the upgrade of ModSecurity from version 3.0.3 to 3.0.6. Note that this addresses a performance regression in ModSecurity 3.0.0 to 3.0.5, which also manifests itself in the Varnish WAF. All users of Varnish WAF are encouraged to upgrade.

Varnish Administration Console 3.9.2

Mon, 20 Dec 2021 01:00:01 +0000

About the release

This is a patch release that includes Log4j2 version 2.17.0, with fixes for CVE-2021-45105.

Varnish Administration Console is not vulnerable by default by CVE-2021-45105 as it requires specific configuration options that can be exploited. This release updates Log4j2 to the latest release to avoid keeping vulnerable versions of Log4j2 even if not affected by it by default.

This version is recommended for all users.

References

Varnish Controller 3.0.3

Thu, 16 Dec 2021 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Added label support for root deployments
Added support to filter on tags at the Varnish Stats endpoints
Fixed a bug where filters with an operator returned incorrect results
Improved Varnish Stats performance

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Administration Console 3.9.1

Wed, 15 Dec 2021 01:00:01 +0000

About the release

This is a patch release that includes Log4j2 version 2.16.0, with fixes for CVE-2021-44228 and CVE-2021-45046.

This version is recommended for all users.

References

Varnish Administration Console Log4j2 CVE-2021-44228 and CVE-2021-45046

Mon, 13 Dec 2021 00:00:00 +0000

Updated December 15, 2021.

Overview

Two vulnerabilities have been discovered in the logging library Log4j2, which is used by Varnish Administration Console. These are identified as CVE-2021-44228 and CVE-2021-45046. Note that no other products from Varnish Software are affected by the same CVEs.

An earlier version of this advisory indicated that a sufficient workaround for affected versions of Varnish Administration Console is to set the log4j2.formatMsgNoLookups=true parameter. As security research has continued to explore the potential of the vulnerabilities, it is clear that this workaround is not sufficient.

Varnish Cache Plus 6.0.9r3

Thu, 09 Dec 2021 08:00:00 +0000

About the release

This release is a bug fix release, fixing several important issues in the new Slicer feature, as well as some minor bug fixes.

See the changelog for the complete list of changes in this release.

References

Varnish Cache Plus 6.0.9r2

Tue, 30 Nov 2021 08:00:00 +0000

About the release

This release corrects an important regression bug that was introduced in Varnish Cache Plus version 6.0.9r1. See the changelog for more information.

References

Varnish Cache Plus 6.0.9r1

Thu, 25 Nov 2021 08:00:00 +0000

About the release

This release reintroduces the Slicer, which should now be ready for prime time. In addition to this, the release includes improvements in the probe-proxy VCL and several bug fixes.

With this release the Via header changes to

Via: 1.1 varnish (Varnish/6.0-plus)

where -plus is new. You can undo this or remove the header entirely in sub vcl_deliver if you do not want to expose the Varnish version you are running.

Varnish Cache Plus 6.0.8r7

Wed, 20 Oct 2021 15:55:00 +0000

About the release

This release contains a single change - the removal of the new Slicer feature. A regression was discovered shortly after the release of 6.0.8r6, and the right solution was to remove the Slicer feature altogether.

The Slicer feature will be reintroduced when the problems have been solved.

Important! MSE stores might have to be rebuilt

There are two cases where you have to rebuild an MSE, where upgrading will not be enough:

Varnish Cache Plus 6.0.8r6 - retracted!

Wed, 20 Oct 2021 08:00:00 +0000

Important! This release has been retracted

Due to a regression in this release, the packages have been removed from the software repository, and are not available for installation.

Version [6.0.8r7]({{ relref “/releases/varnish-cache-plus-6.0.8r7.md” >}}) has been released, and should be installed instead. Read the announcement if you have installed 6.0.8r6 on any of your servers.

Contact support@varnish-software.com if you need assistance in this process.

About the release

The major highlights of this release are the new Image VMOD that enables image conversions from VCL, and also the new Slicer VMOD that can transparently break down very large objects into smaller parts that are individually cached.

Varnish Controller 3.0.2

Tue, 19 Oct 2021 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Fixed a bug where root deployments could not be used with invalidations
Fixed a bug where organization accounts could not use invalidations
Added deployedAt date and time to the agentStates property of the VCLGroups

See Varnish Controller Changelog for more details on the changes and the upgrade notes for more details on how to upgrade.

This update is recommended for all users.

Varnish Cache Plus 6.0.8r5

Fri, 08 Oct 2021 08:00:00 +0000

About the release

This release is a bug fix release. All users of Varnish Enterprise 6 are encouraged to update to this version.

Bugs fixed:

Fixed an off-by-one bug in xbody.log_body that would in rare cases lead to a panic.
Fix a race in varnishtest cyclic barriers where the barrier could lose count of the number of waiters and deadlock the test.
Experimental VMOD vmod_stat has received several format fixes to both its prometheus and JSON output backends.

Varnish Controller 3.0.1

Wed, 06 Oct 2021 00:00:01 +0000

This is a patch release for Varnish Controller with the following fixes:

Persistent Statistics Update

Statistics of the type counter is now showing the counts per time frame and not average.
Statistics that are of the type boolean or gauge will still be averaged for the given time frame.
MAIN.uptime will not be part of aggregation.
Support for vmod-goto counters has been removed for now.
Statistics of type bitmap are not persistently stored.
Flag added to counter output (showing type of counter, same as for Varnishstat)

NOTE: All periodical statistics will be cleared due to the change of counter handling, this is to avoid having wrong data shown for counters.

Varnish Controller 3.0.0

Tue, 28 Sep 2021 00:00:01 +0000

This release is NOT backward compatible with 2.0.5. All Varnish Controller components requires an upgrade.

The release includes bug fixes, new features and improvements.

In most cases, no configuration changes is required after upgrade. It will be enough to upgrade packages and make sure that the component services gets restarted.

New Features

Invalidation (purging, banning and tag-based)
Per VCLGroup statistics via integration with from vmod-accounting
Persistent statistics
Customizable dashboards
Updated and overhauled the web based UI

Improvements

Parallel asynchronous VCLGroup deployments
CSV output from the CLI
Compile state in the CLI
Performance improvements

And more…

Varnish Controller 2.0.5

Wed, 15 Sep 2021 00:00:01 +0000

This is a patch release that optimizes statistics inserts into the database, lowering CPU usage of Brainz. It also normalizes dynamic backends statistic counters for the vmod-goto. Meaning that stored statistic counters from vmod-goto in Varnish Controller will have the ID from the counter name removed.

Example:

goto.000004f.(127.0.0.1).(http://example.com:80).(ttl:10.000000).conn => goto.(127.0.0.1).(http://example.com:80).(ttl:10.000000).conn

Upgrading from 2.0.4 does not require any configuration changes to any of the components.

See Varnish Controller Changelog.

This update is recommended for all users.

Varnish Cache Plus 6.0.8r4

Thu, 26 Aug 2021 12:00:00 +0000

About the release

This release contains several bug fixes and a few minor features.

New features:

Add urlplus.query_set() to update query values.
In varnishadm, the backend.list commands now supports -j.
A counter for the number of ESI sub requests has been added.
For backend transactions, there are now new timestamps called Fetch, Connected and Process.
The accounting VMOD’s counter set for keys now includes grace_hit.

Bugs fixed:

Backend_health log records no longer display (null) as the name the first time it is logged.

Varnish Controller 2.0.4

Tue, 17 Aug 2021 00:00:01 +0000

This is a patch release that includes a fix for growing snapshots database table and fixes a panic in brainz.

Upgrading from 2.0.3 does not require any configuration changes to any of the components.

See Varnish Controller Changelog for more details.

This update is recommended for all users.

Varnish HTTP/2 Request Smuggling

Tue, 13 Jul 2021 10:00:00 +0000

Overview

A request smuggling attack can be performed on Varnish Cache and Varnish Cache Plus servers that have the HTTP/2 protocol enabled. The smuggled requests do not go through normal VCL processing, and any authorization steps implemented in VCL would be bypassed.

The responses to the smuggled requests can under some circumstances also be obtained by the attacker. Also, it may be possible for an attacker to use this for cache poisoning, where the response to a smuggled request is inserted as the cached content.

Varnish Broadcaster 1.5.2

Mon, 12 Jul 2021 00:00:01 +0000

Broadcasting statistics with methods
Argument/man-page documentation updates for connection management
Better UI support for a proxy environment.

See Broadcaster Changelog page for more details.

Varnish Controller 2.0.3

Wed, 30 Jun 2021 00:00:01 +0000

This is a patch release that includes a couple minor bug fixes and improvements.

Upgrading from 2.0.2 does not require any configuration changes to any of the components.

See Varnish Controller Changelog for more details.

This update is recommended for all users.

Varnish Cache Plus 6.0.8r3

Tue, 15 Jun 2021 10:00:00 +0000

About the release

This is a bugfix release fixing smaller issues, some of which was introduced in the previous feature release.

New features:

Increased the MAX_HDR limit in varnishtest from 50 to 256.

Bugs fixed:

Fix a vmod_goto bug introduced in 6.0.8r2, where creating two identical dns_director objects would trigger an assert. (VS issue #1176)
Fix a NULL pointer dereference in an error handling path in the JWT VMOD.
Fix a NULL pointer dereference when setting namespaces in the Accounting VMOD.

Varnish Cache Plus 6.0.8r2

Wed, 02 Jun 2021 08:00:00 +0000

About the release

This release, contains a long list of new features and many bug fixes.

The new features include the following:

A new VMOD accounting has been added. It lets you create namespaces and add counters to each namespace which can track lot of useful statistics on traffic flowing in and out of Varnish.
A new VMOD uri has been added. It makes it easy to parse a URI into the five generic components: scheme, authority, path, query and fragment.

Varnish Controller 2.0.2

Mon, 10 May 2021 00:00:01 +0000

This is a patch release that includes several minor bug fixes and improvements.

Upgrading from 2.0.1 does not require any configuration changes to any of the components.

See Varnish Controller Changelog for more details.

This update is recommended for all users.

Varnish Controller 2.0.1

Tue, 04 May 2021 00:00:01 +0000

This is a patch release that includes several minor bug fixes and improvements.

Upgrading from 2.0.0 does not require any configuration changes to any of the components.

Changes That Requires Action

If the VCLI is used via automation the need for -y (or --yes) flag is required for several commands listed below. This is to prevent showing the interactive prompt that has been added for these commands. The need for interactive input has been added as a safeguard and can be circumvented using the -y flag for the commands that accept this flag.

Varnish Controller 2.0.0

Fri, 23 Apr 2021 00:00:01 +0000

This release is NOT backward compatible with 1.0.4. All Varnish Controller components requires an upgrade.

The release includes bug fixes, new features and improvements.

In most cases, no configuration changes is required after upgrade. It will be enough to upgrade packages and make sure that the component services gets restarted.

New Features

Draft and rollbacks of VCL files (VCLGroups)
Organization private tags
New endpoint /api/v1/ownerships (only accessible as system admin)
Ownership of resources in the VCLI
Agent locking if database has been reset/removed (see agents chapter)
Sorting using query parameter sort=<column>[:asc|desc] (VCLI and API)
Pagination using query parameter take=<limit>[,<offset>] (VCLI and API)
Self-signed TLS support in VCLI

Improvements

Possible to fetch metrics per agent with VCLI
VCLI no longer support -p for password (support for ENV variables instead)
No longer required to input organization when logging in with VCLI
Brainz arguments to specify TLS certs for the database
VCLI JSON output improved
Agents include what static tags they are configured with
Assign an account to multiple organizations using filters in VCLI.

Changes That Requires Action

Since this is a major release, there are several things that breaks the interface in terms of output from VCLI. However, the REST API has not been changed in a breaking way, only appended to.

Varnish Cache 6.5 / Varnish Modules 0.17.0 Denial of Service

Tue, 16 Mar 2021 08:00:00 +0000

Details

A problem has been found in the Header VMOD of the Varnish Modules collection of frequently used VMODs. It applies to version 0.17.0 of Varnish Modules, which is only compatible with the 6.5 version of Varnish Cache.

It makes it possible for common usage patterns of the Header VMOD in VCL to open up remote triggering of an assert or NULL pointer dereference in Varnish Cache, causing Varnish Cache to assert and restart.

Varnish Cache Plus 6.0.8r1

Thu, 11 Mar 2021 09:00:00 +0000

About the release

This release, 6.0.8r1, fixes a number of bugs, and introduces a few minor features. The new features include the following:

The file VMOD now supports 304 Not Modified.
Improvements in the kvstore VMOD’s auto decrementing counters.
The new function std.bytes() can convert strings like 1GB to a value of type BYTES.
A new function called utils.hash_ignore_vary() can be used to force a hit on any variant that might be in the cache.

Varnish Controller 1.0.4

Tue, 23 Feb 2021 00:00:01 +0000

This release includes several bug fixes.

See Varnish Controller Changelog for more details.

This update is recommended for all users.

Varnish Cache Plus 6.0.7r3

Tue, 09 Feb 2021 15:00:00 +0000

About the release

This release, 6.0.7r3, fixes a number of bugs, and introduces a few minor features. The new features include the following:

A new resp.send_timeout variable to set the send timeout on a per-request basis from vcl.
varnishncsa now supports Epoch timestamps.
MSE variable memory_target can now be negative for non % tagged value, indicating how much memory to leave unused on the system.
Object misses can now be counted via utils.backend_misses() to allow objects to be inserted on the 2nd miss.

Varnish Controller 1.0.3

Tue, 09 Feb 2021 00:00:01 +0000

This release includes several bug fixes and also some new backward compatible additions.

See Varnish Controller Changelog for more details.

This update is recommended for all users.

Varnish Discovery 1.2.0 release

Wed, 27 Jan 2021 10:00:00 +0000

This release introduces two changes that help set up update-reload pipeline:

nodes and groups are now sorted before being rendered, to ease comparison between two outputs.
the -postudate argument has been introduced, allowing discovery to run commands after a group change.

References

Varnish Discovery changelog

Varnish Controller 1.0.2

Tue, 26 Jan 2021 00:00:01 +0000

A license file is now required. The license file is added to brainz. Please contact sales or support to retrieve a license file. The system will continue running without a license file, but login is disabled for all users.

Small improvements and bug fixes in Brainz, Agent, API-GW, CLI, UI Server and the UI.

Packaging has been updated with the following:

RPM packages for brainz now installs nats.conf correctly.
Varnish-Controller user is now part of the varnish group for the agent.
Varnish Controller UI systemd service file updated to use default values from the ui-server.

See Varnish Controller Changelog for more details.

Varnish Cache Plus 6.0.7r2

Thu, 14 Jan 2021 16:00:00 +0000

About the release

This release, 6.0.7r2, fixes a number of bugs, and introduces a few minor features. The new features include the following:

A new counter, MAIN.fetch_stale_rearm for rearm() and revive()
A new function, utils.resolve_backend() is now available.
There is a new VHA6 setting for disabling VCS logging.
In varnishncsa there is a new format option; log request time in milliseconds
There is a port_rule optional parameter to vmod_goto. Default abide will use port from SRV record, while force will use the port parameter.

Varnish Controller 1.0.1

Mon, 04 Jan 2021 00:00:01 +0000

First release of Varnish Controller.

See Varnish Controller Documentation page for more details.

Varnish Cache Plus 6.0.7r1

Mon, 21 Dec 2020 08:00:00 +0000

About the release

This release, 6.0.7r1, contains a number of improvements and fixes. Most notably, the following is new:

A brand new varnishscoreboard is available.
SSL/TLS backends now support transmitting a client certificate as part of the TLS handshake
The tls VMOD can now also be used in vcl_backend_response, to inspect the state of a TLS backend connection.
The kvstore VMOD has a static scope, which allows keeping kvstore content across VCL reloads.

Varnish Custom Statistics 6.1.0

Mon, 16 Nov 2020 00:00:00 +0000

The vcs-agent will now send a PING ZMTP (heartbeat) command every 3000 milliseconds.
Introduces a new user interface (v2).

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish Broadcaster 1.5.1

Tue, 03 Nov 2020 00:00:01 +0000

Fixes a bug that could cause panic during hot-reload of configuration file.

See Broadcaster Changelog page for more details.

This update is recommended for all users.

Varnish Broadcaster 1.5.0

Tue, 20 Oct 2020 00:00:01 +0000

New mgmt-host option added for binding to different host on management interface
New mgmt-on option added to enable/disable management interface.
Statistics endpoint added /api/v1/stats and /api/v1/stats/reset.
Improved port validation for port arguments.

See Broadcaster Changelog page for more details.

This update is recommended for all users.

Varnish Cache Plus 6.0.6r10

Fri, 16 Oct 2020 08:00:00 +0000

About the release

This release introduces Brotli compression support in Varnish Cache Plus. This enables Varnish to handle Brotli compressed content from the backend, on the fly Brotli compression of fetched data, and serving of Brotli compressed content to clients that advertise Brotli support. See the Brotli VMOD documentation for more information.

Several minor features and bug fixes are also in this release. For the complete list, please see the Changelog.

References

Varnish Cache Plus 6.0.6r9

Wed, 30 Sep 2020 14:00:00 +0000

About the release

This is a bug fix release, that fixes a performance regression when using the built in client TLS termination. This problem would show up as an influx of client TLS connections being dropped as bad requests when the system is under load.

For a complete list of features and bug fixes from this and previous versions, please see the Changelog.

References

Varnish Broadcaster 1.4.1

Mon, 31 Aug 2020 00:00:01 +0000

This release fixes a rare timeout issue that could occur at high load.

See Broadcaster Changelog page for more details.

This update is recommended for all users.

Varnish Administration Console 3.9.0

Mon, 24 Aug 2020 05:30:01 +0000

Minor release that fixes various CVEs due to usage of old libraries.

This version is recommended for all users.

References

Varnish Cache Plus 6.0.6r8

Tue, 11 Aug 2020 14:00:00 +0000

About the release

This release introduces the resolver VMOD that enables doing reverse IP DNS resolution and verification from VCL, as well as veribot VCL library to enable domain-based access controls.

The Akamai Connector and it’s accompanying VCL library now has a VCL 4.1 version available, which makes it easier to integrate into existing configurations based off of VCL version 4.1.

Several bug fixes are also in this release, notably in MSE and libvmod_goto.

Varnish Broadcaster 1.4.0

Tue, 11 Aug 2020 04:00:01 +0000

This release adds the -confwatch switch to reload configuration file automatically if it changes.

See Broadcaster Changelog page for more details.

This update is recommended for all users.

Varnish Administration Console 3.8.6

Wed, 08 Jul 2020 05:30:01 +0000

Patch release which fixes an issue of not showing the VAC version.

This version is recommended for all users.

References

Varnish Custom Statistics 6.0.4

Fri, 03 Jul 2020 00:00:00 +0000

Fix an underflow issue causing some counters to display the wrong value.
Counters have been added to track piped requests

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish Cache Plus 6.0.6r7

Tue, 30 Jun 2020 14:00:00 +0000

About the release

This is a bug fix release to address a packaging issue with the previous release, as well as fixing some bugs in VHA6, MSE and a couple of VMODs.

For a complete list of features and bug fixes from this and previous versions, see the Changelog.

References

Varnish Cache Plus 6.0.6r6

Wed, 24 Jun 2020 15:20:00 +0000

About the release

This release introduces the new headerplus VMOD for advanced header manipulation. It also improves several VMODs (http, xbody and crypto) and VHA6.

In addition to the above, several minor bugs are fixed.

For a complete list of features and bug fixes from this and previous versions, see the Changelog.

References

Varnish Discovery 1.1.0 release

Mon, 22 Jun 2020 10:00:00 +0000

The biggest item of this release is the support for the Azure platform, but it also simplifies the AWS setup by automatically trying to find the AWS configuration file from the user name.

References

Varnish Broadcaster 1.3.1

Mon, 15 Jun 2020 04:00:01 +0000

This is a patch release to fix an issue with TLS automatic server name verification.

See Broadcaster Changelog page for more details.

This update is recommended for all users.

Varnish Broadcaster 1.3.0

Mon, 08 Jun 2020 04:00:01 +0000

This Varnish Broadcaster release addresses some known issues and adds some new functionality.

Some highlights of this update includes:

New broadcasting headers added.
User interface included in package and supports TLS enabled broadcaster.
Various bug fixes.
Performance improvements.
Lower memory usage
Modes for TLS verification towards nodes.

See Broadcaster Changelog page for more details.

This update is recommended for all users.

Varnish Administration Console 3.8.5

Wed, 27 May 2020 05:30:01 +0000

Mongo driver has been upgraded to 2.14.3.
SSL support for self signed certificates.
Various small fixes in regards to RRD issues.

This version is recommended for all users.

References

Varnish Agent 6.2.6

Wed, 20 May 2020 00:30:01 +0000

This is a minor release with updated boot.vcl. The packaging for boot.vcl has been updated as well.

See varnish-agent changelog for more details.

Varnish Cache Plus 6.0.6r5

Tue, 28 Apr 2020 10:20:00 +0000

About the release

This release introduces a few minor feature updates and the new TLS vmod, which lets users of in-core TLS get additional information about the connection.

There are also two bug fixes:

Fix a bug introduced in 6.0.6r3 where local /etc/hosts resolution in VMOD goto did not work.
Fix a bug in the MSE object iteration code that could assert when handling a range request, and the fetch thread aborted due to a short read (VS issue 809).

Varnish Cache Plus 6.0.6r4

Wed, 08 Apr 2020 10:40:00 +0000

About the release

This release contains two important bug fixes:

Sometimes the Ban Lurker and the Memory Governor would step on each other’s toes, and MSE would not start up. The ban lurker now patiently waits until the Memory Governor has set itself up.
The stale vmod would incorrectly treat a hit-for-miss object as a stale object for a transaction. This bug is now fixed.

For a complete list of features and bug fixes from this and previous versions, see the Changelog.

Varnish Cache Plus 6.0.6r3

Mon, 30 Mar 2020 16:40:00 +0000

About the release

This release contains both new features and a few bug fixes.

All users of Varnish Enterprise are encouraged to upgrade.

The main new features are:

Support for SRV records in VMOD goto.
VMOD sqlite3 in the varnish-plus-vmods-extra package.
VMOD stale, a new way of doing stale-while-revalidate and stale-on-error without having to resort to restarts.

For a complete list of features and bug fixes, see the Changelog.

References

Varnish Agent 6.2.5

Mon, 23 Mar 2020 00:30:01 +0000

This release now supports loading of TLS certificates that are owned by root.

See varnish-agent changelog for more details.

This update is recommended for all users.

Varnish Cache Plus 6.0.6r2

Wed, 18 Mar 2020 10:30:00 +0000

About the release

This release contains several new features and a few bug fixes.

All users of Varnish Enterprise are encouraged to upgrade.

The main new features are:

The new JWT VMOD. This VMOD makes it practical to manipulate JWT in VCL.
Built in client side TLS support. This feature was developed for users who need to squeeze out the maximum amount of data on the newest network hardware. For other users we still recommend keeping hitch as the TLS terminator.

Varnish Agent 6.2.4

Tue, 03 Mar 2020 00:30:01 +0000

This update fixes several issues and also adds some new functionality.

The agent will no longer have to be restarted if it is started before VAC is running. It will now try to connect to VAC every 5 seconds if not yet registered.
A new parameter has been added to better control commands towards varnishd. The new -w parameter configures number of seconds before timing out when trying to authenticate with varnishd. If varnishd is highly loaded this value might have to be increased. The previous parameter -t is still valid but for the actual command executed. A command could be the loading of VCL through VAC, which in some cases can take a lot of time to complete during VCL compilation of large VCL files. For most cases, the new parameters default value of 10 seconds should be enough. The new parameter was added in combination of handling too many open sockets due to highly loaded varnishd or while currently deploying a large VCL.

Varnish Cache Plus 6.0.6r1

Wed, 19 Feb 2020 14:51:00 +0000

About the release

This release contains many fixes and some new features.

All users of Varnish Enterprise are encouraged to upgrade.

Most notably we have fixes in H2 code and VHA, but there are also fixes in the JSON output of varnishlog and of how grace works when caching requests which have a request body.

Among the new features are a faster MSE startup and more VHA counters. For a complete list of features and bug fixes, see the Changelog.

Varnish Broadcaster 1.2.4

Tue, 18 Feb 2020 07:00:01 +0000

This Varnish Broadcaster release addresses some known issues and adds some new functionalities.

Fixes a rare race condition that could cause a panic while fetching status.
Improved error handling for host parsing
Versioning of management API added (/api/v1), /api/ still works and is the same as v1.
Updated man page to describe the -log argument correctly and added missing parameters.
Updated man page with header normalization information.
Systemd service file updated to create pid file at startup.
Added header X-Broadcaster-Ua to broadcasted requests containing broadcaster version (eg. Broadcaster/1.2.4)
New random broadcast functionality added (X-Broadcast-Random)
Limit of 10240 open files in systemd service file.

See Broadcaster page for more details.

Varnish HTTP Proxy Protocol V2 Denial of Service

Tue, 04 Feb 2020 10:00:00 +0000

Overview

An assert can be triggered in Varnish Cache and Varnish Enterprise when using Varnish with a TLS termination proxy, and the proxy and Varnish use the PROXY version 2 protocol to communicate connection details. Depending on the type of proxy used and the details it include in the proxy payload, it may be possible for remote clients to cause Varnish to assert and restart, making it a denial of service attack.

Varnish Cache Plus 6.0.5r3

Tue, 07 Jan 2020 05:59:59 +0000

About the release

This release improves VHA6 by making it aware of fast_304.

There are also a few bug fixes, and we encourage users to upgrade to the newest version.

See Changelog for more details.

References

Varnish Cache Plus 4.1.11r5

Thu, 05 Dec 2019 11:58:00 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r5.

About the release

This release adds support for the -j flag in varnishncsa and fixes varnishreload for very big VCL files.

Note that if you are not already running 4.1.11r4, this release also fixes a request and response parsing bug (vsv00003).

See the change log for details on this and previous releases.

Varnish Cache Plus 6.0.5r2

Thu, 28 Nov 2019 05:59:59 +0000

About the release

This release introduces json.contains(), and support for if-range in conditional requests.

There are also several important bug fixes, and we encourage users to upgrade to the newest version.

See Changelog for more details.

References

Varnish Administration Console 3.8.4

Wed, 13 Nov 2019 05:30:01 +0000

Fixes a bug where parameters in database were multiplied. If parameters are handled in VAC through the Web based UI, please review parameters for all parameter sets in VAC (Configure -> Parameters(gray button) -> Edit -> [Review all values]), then press ‘Save Changes’ even if no changes were made. Repeat for each parameter set. This will update the database correctly.
Support for missing parameters in Varnish Enterprise 4.1 clock_step mse_delay_writes mse_membuf_pool mse_membuf_size mse_nuke_limit mse_pad_writes mse_prune_factor mse_prune_loop pool_sslbuffer ssl_buffer startup_timeout thread_pool_reserve
Support for missing parameters in Varnish Enterprise 6.0 allow_exec backend_local_error_holddown backend_remote_error_holddown crypto_buffer h2_header_table_size h2_initial_window_size h2_max_concurrent_streams h2_max_frame_size h2_max_header_list_size object_mutex_slots scoreboard_active scoreboard_enable thread_pool_watchdog vsm_publish_interval
Bad things graph no longer present 0.5 as 500m

This version is recommended for all users.

Varnish Cache Plus 6.0.5r1

Thu, 24 Oct 2019 13:00:02 +0000

About the release

This release introduces namespaces in VMOD ykey, the MSE vmod, last_byte_timeout in backend fetches, and several other other improvements.

There are also some important bug fixes, and we encourage users to upgrade to the newest version.

See Changelog for more details.

References

Varnish Broadcaster 1.2.3

Tue, 22 Oct 2019 09:00:01 +0000

Let systemd help the broadcaster to write its pid
Handle IP with port in configuration file
Put back client connection into connection pool

This update is recommended for all users.

Varnish HTTP Workspace information leak vulnerability

Mon, 21 Oct 2019 10:00:00 +0000

Overview

A bug has been discovered in Varnish Cache and Varnish Plus where we fail to clear a pointer between the handling of one client requests and the next on the same connection. This can under specific circumstances lead to information being leaked from the connection workspace.

The vulnerability was discovered by Trygve Tønnesland of VG/Schibsted, a Varnish Software customer. We wish to thank them for their responsible disclosure.

Impact

The impact is an information leak, limited to the data in the workspace used for handling the connection. This will typically be data structures and stale header data from previous requests on the same connection, but could also be temporary headers set during processing of VCL.

Varnish Agent 6.2.3

Thu, 10 Oct 2019 00:30:01 +0000

Make sure that vcl folder is correctly set.
Write HTTP return code before write of body

This update is recommended for all users.

Varnish Cache Plus 6.0.4r3

Fri, 27 Sep 2019 11:00:02 +0000

About the release

This release introduces a new experimental tool called varnishscoreboard, and a new string VMOD. It also adds a utils function and adds IPv6 support to the aclplus VMOD.

It also fixes a few bugs, for example one which improves the format of the newly added -j option in varnishncsa.

See Changelog for more details.

References

Varnish Agent 6.2.2

Thu, 26 Sep 2019 00:30:01 +0000

Fixed leaking tcp connections against varnishadm.
Fixed default boot.vcl template

This update is recommended for all users.

Varnish Custom Statistics 6.0.3

Thu, 19 Sep 2019 00:00:00 +0000

Fix an issue where -O output would sometimes miss updates.

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish Cache Plus 6.0.4r2

Wed, 11 Sep 2019 11:00:02 +0000

About the release

This release fixes a critical bug in the new VSM code and an extremely unlikely bug in MSE (discovered when running with very limited resources and heavy traffic).

A new -j option for JSON compatible output has been added in varnishncsa.

See Changelog for more details.

References

Varnish Cache Plus 6.0.4r1

Thu, 05 Sep 2019 08:00:00 +0000

About the release

This release fixes several bugs and reduces the load in the utilities (varnishncsa, varnishstat etc.)

In addition to improvements in VSM handling, VHA6 received fixes and improvements such as YKey support and HMAC signatures on origin responses.

See Changelog for more details.

References

Varnish HTTP Cache DoS vulnerability

Tue, 03 Sep 2019 10:00:00 +0000

Overview

An assert can be triggered in Varnish Cache and Varnish Enterprise by a remote client sending specially crafted HTTP requests. Varnish will panic and restart when the assert is triggered, which constitutes a denial of service attack.

This was discovered by Varnish Software.

Impact

The potential impact is reduced or completely lost availability.

The cache will be empty after the restart unless Massive Storage Engine is used in persistence mode. An empty cache after restart will reduce overall performance due to an increased number of cache misses, and may cause higher load on the backend servers.

Varnish Custom Statistics 6.0.2

Tue, 03 Sep 2019 00:00:00 +0000

Skip VHA6 requests when using default keys
Fix JSON streaming output
Handle -O write errors: Write on a closed socket would trigger a SIGPIPE which we fail to handle, leading to an immediate crash.

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish Broadcaster 1.2.2

Thu, 29 Aug 2019 11:00:01 +0000

This Varnish Broadcaster release addresses a minor issue in regards with relaxing the parsing of the group names. It is now possible to include dashes and underscores in the group names.

This update is recommended for all users.

Varnish Agent 6.2.1

Wed, 28 Aug 2019 11:00:01 +0000

Added gzip support over all endpoints.
Added https support.
Report X-Forwarded-Proto if https to vac
Added gorilla mux
Added a versioned api namespace under /api/v1

This update is recommended for all users.

Varnish Administration Console 3.8.3

Wed, 28 Aug 2019 09:30:01 +0000

Upgrade the mongo java driver to 2.13.2
Added various log calls throughout the code to help with support
VCL editor improvements
Added the options to secure the unrestricted /stats endpoint if a rest_api_token is set in the defaults file

This version is recommended for all users.

References

Varnish Broadcaster 1.2.1

Thu, 22 Aug 2019 11:00:01 +0000

This Varnish Broadcaster release addresses some known issues and adds some new functionalities.

Fixed goroutine leak in async mode
Added a configurable keep-alive
Added a configurable broadcast req timeout
Extended cors support
Write a pid file to report the pid of the running instance

This update is recommended for all users.

Varnish Cache Plus 4.1.11r4

Mon, 19 Aug 2019 08:00:00 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r3.

About the release

This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 4.1.x.

The release fixes handling of null values in libvmod_urlplus, fixes a bug in MSE related to empty synthetic responses, and fixes a request and response parsing bug (vsv00003).

Varnish Cache Plus 6.0.3r9

Mon, 19 Aug 2019 08:00:00 +0000

About the release

This release fixes a corner case where the CPU usage improvements for the varnishlog family of utilities would only take effect if the utility was run as root, and a bug related to request and response parsing (vsv00003).

This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 6.0.x.

See Changelog for more details.

References

Varnish Cache Plus 6.0.3r8

Tue, 06 Aug 2019 07:30:02 +0000

About the release

This release fixes several bugs, and improves the efficiency of the shared memory counters framework.

If you have many dynamic backends with various TTLs, many counters will be created and retired. This use case was previously not optimized, and tools like varnishncsa, varnishlog and varnishstat saw a lot of CPU usage. This has been fixed, but you may experience that it can take up to one second before the new counters appear in the varnishstat interface. This time is configurable through the parameter vsm_publish_interval.

Varnish Cache Plus 6.0.3r7

Wed, 24 Jul 2019 08:00:02 +0000

About the release

This release fixes some bugs, and adds a new VMOD mmdb.

VMOD mmdb - Varnish Enterprise GeoIP2, supersedes the now deprecated VMOD geoip.
Improve persisted MSE startup performance. At restarts of the cache, data structures for the persisted objects needs to be set up. This can be CPU intensive, and with this rewrite of the subsystem all of the available CPU resources will be utilized to get it done quickly.

Varnish Cache Plus 6.0.3r6

Thu, 13 Jun 2019 11:00:02 +0000

About the release

This release fixes some bugs, and adds VHA 6.

The old VHA is still supported, and customers who want to switch to the new version can do that when they are ready, with out installing new packages.

See Changelog for more details.

References

Varnish Cache Plus 4.1.11r3

Thu, 13 Jun 2019 11:00:00 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r3.

About the release

This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 4.1.x.

This release contains a single fix: The varnishncsa will now also log lines when the backend produces responses with bad HTTP.

Varnish Discovery 1.0.4 release

Fri, 07 Jun 2019 10:00:00 +0000

Add an option to extend the format of the nodes.conf file.

References

Varnish Cache Plus 6.0.3r5

Wed, 22 May 2019 11:50:02 +0000

About the release

This release fixes some bugs, and adds a few features. The main features are

LDJSON (Line Delimited JSON) support for varnishlog
A hash_body function in the xbody VMOD.

See Changelog for more details.

References

Varnish Cache Plus 4.1.11r2

Wed, 10 Apr 2019 12:00:00 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r2.

About the release

This release is a bug fix release, and is recommended for all users of Varnish Cache Plus 4.1.x.

The previous release, 4.1.11r1, changed the ABI slightly, and this release fixes it. For this reason, 4.1.11r1 will be removed from the repository.

Varnish Cache Plus 6.0.3r4

Wed, 10 Apr 2019 09:30:02 +0000

About the release

It is a bugfix release, with two new features

regsub support in VMOD cookieplus.
ACL support in VMOD goto

See Changelog for more details.

References

Varnish Administration Console 3.8.2

Thu, 28 Mar 2019 09:30:01 +0000

This Varnish Administration Console (VAC) patch release fixes Purger bug concerning client SocketTimeouts.

This version is recommended for all users.

References

Varnish Cache Plus 6.0.3r3

Mon, 18 Mar 2019 14:00:02 +0000

About the release

It is a bugfix release, containing some important fixes mostly in the MSE / ESI / ES area.

See Changelog for more details.

References

Varnish Cache Plus 6.0.3r2

Tue, 05 Mar 2019 10:00:02 +0000

About the release

It is a bugfix release, containing various MSE3 and some SELinux fixes.

See Changelog for all the details.

References

Varnish Cache Plus 6.0.3r1

Tue, 26 Feb 2019 10:00:02 +0000

About the release

This update of Varnish Cache Plus 6 contains many updates from Varnish Cache (community edition) and also numerous change which is exclusive to Varnish Enterprise (previously Varnish Cache Plus).

See Changelog for all the details.

References

Varnish Agent 6.2.0

Tue, 19 Feb 2019 11:00:01 +0000

The stats endpoint can now return only specific counters when using the counters query param. Counters are specified by their name and are comma separated. E.g: /stats?counters="Main.client_req,Main.cache_hit".
GET endpoints honor the Accept-encoding header and will return gzipped responses if asked for.
Stats data are no longer pushed against the VAC if the -i option is set to 0.
When upgrading from earlier versions, the agent_secret file is left untouched.
Various other small improvements.

This update is recommended for all users.

Varnish Cache Plus 4.1.11r1

Wed, 13 Feb 2019 07:25:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th 2017) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.11r1.

About the release

This release contains the reintroduction of req.grace from Varnish Cache 3, and a fix of a rare bug in MSE.

See the change log for details on this and previous releases.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Cache Plus 6.0.2r1

Wed, 30 Jan 2019 10:00:02 +0000

About the release

This update of Varnish Cache Plus 6 contains many updates from Varnish Cache (community edition) and even more that is exclusive to Varnish Enterprise (previously Varnish Cache Plus).

See Changelog for all the details.

References

Varnish Cache Plus 4.1.10r6

Tue, 08 Jan 2019 16:25:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r6.

About the release

This release contains several bug fixes in the core some VMODs (urlplus and cookieplus). We encourage all users on 4.1 to upgrade to this version.

See the change log for details on this and previous releases.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Discovery 1.0.2 release

Mon, 24 Dec 2018 10:00:00 +0000

This is purely a feature release, adding support to AWS autoscaling groups.

References

Varnish Discovery documentation

Varnish Cache Plus 6.0.1r5

Tue, 18 Dec 2018 13:38:02 +0000

About the release

This update of Varnish Cache Plus 6 contains a couple of new features in XBody, as well as fixes for a couple of bugs found in the previous release.

See Changelog for all the details.

References

Hitch 1.5.0

Mon, 17 Dec 2018 15:12:03 +0100

About the release

This release brings support for UNIX domain sockets, TLS 1.3 and a few other new features.

Have a look at the changelog for more details.

References

Varnish Cache Plus 6.0.1r4

Wed, 05 Dec 2018 16:03:02 +0000

About the release

This update of Varnish Cache Plus 6 contains fixes for a couple of bugs found in the previous release.

See Changelog for all the details.

References

Varnish Agent 6.1.0

Mon, 03 Dec 2018 11:00:01 +0000

Ping endpoint does not check against a Varnish instance anymore.
The stats payload has been stripped of unnecessary tags.
The agent can now specify a bind address. (see -a parameter)
Various other small improvements.

This update is recommended for all users.

Varnish Cache Plus 6.0.1r3

Fri, 23 Nov 2018 16:23:02 +0000

About the release

This update of Varnish Cache Plus 6 contains the new version of MSE, MSE 3, which is a significant improvement over previous versions. This version has been tested thoroughly in the lab, and it has also been running successfully in production on some high traffic sites for several weeks. Varnish Software is very happy about its performance, and encourage all customers to try it out.

The documentation on MSE 3 will be available here soon, but you can get a head start by reading the mkfs.mse man page after upgrading.

Varnish Broadcaster 1.2.0

Wed, 21 Nov 2018 11:00:01 +0000

This Varnish Broadcaster release addresses some known issues and adds some new functionalities.

Broadcast client request body
Fixed a bug concerning Hashmap keys memory release
Various other small fixes

This update is recommended for all users.

Varnish Custom Statistics 6.0.1

Sat, 03 Nov 2018 00:00:00 +0000

Fixed issue when logging in with no password
Set all responses to Vary on Authorization

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish Discovery 1.0.1 release

Tue, 16 Oct 2018 10:00:00 +0000

This release addresses a bug in the Kubernetes module causing a out-of-bound exception and crashing discovery. It also fixes two pain points in case of misconfiguration:

For VAC and Kubernetes, in case of an HTTP error, the response is dumped as a comment to help debugging.
In the same modules, if no matching group is found, discovery will output a comment too, instead of looping or exiting silently.

Upgrading is safe and recommended.

Varnish Agent 4.1.4

Thu, 04 Oct 2018 11:00:01 +0000

This Varnish Agent release addresses some known issues and adds some new functionalities.

Fixed uploading large VCL files
Fixed EL 6 compilation issue
Added option to set the host for the running agent
Fixed faulty probe json encoding
Various other small fixes

This update is recommended for all users.

Varnish Administration Console 3.8.1

Tue, 02 Oct 2018 09:30:01 +0000

This Varnish Administration Console (VAC) release fixes some minor UI bugs, adds a feature to enable ReadOnly user to view VCL and Parameter sets and introduces MongoClient connection string.

A new argument - mongoURI - is available in the defaults settings file. If this argument has any value assigned to it then it will be used as a connection string against Mongo.

References

Varnish Cache Plus 6.0.1r2

Mon, 01 Oct 2018 11:00:02 +0000

About the release

This update of Varnish Cache Plus 6 is a bug fix release of Varnish Cache Plus 6. It contains a few bug fixes, and we encourage all users of 6.0.1r1 or earlier to upgrade.

For users of Varnish Cache Plus 4 variants, the upgrade path is relatively simple. VCLs will typically work unmodified with the new version, but if you need Unix Domain Sockets support, you need to change the VCL version at the top of your VCL.

Varnish Cache Plus 4.1.10r5

Mon, 01 Oct 2018 10:00:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r5.

About the release

This release contains several bug fixes and some new features (updates to urlplus and rewrite plus a new VMOD: session). We encourage all users on 4.1 to upgrade to this version.

See the change log for details on this and previous releases.

Varnish Cache Plus 6.0.1r1

Thu, 20 Sep 2018 11:00:01 +0000

About the release

This update of Varnish Cache Plus 6 contains a high number of bug fixes and improvements. With this release we also makes Varnish 6 available to more customers than the Limited Availability version 6.0.0, and we expect very few problems for those who upgrade from Varnish Cache Plus 4.1 versions. Recompiling VMODs and external tools is necessary, and in most cases the code will work unmodified. Customers upgrading from Limited Availability versions (6.0.0 variants) should also recompile to be on the safe side.

Varnish Administration Console 3.8.0

Mon, 27 Aug 2018 12:00:01 +0000

Important: We have added a new configuration file /opt/vac/etc/logback.xml and made some changes in the /opt/vac/etc/log4j.xml, /opt/vac/etc/defaults and service unit file to introduce proper logging in systemd. If you have made any changes to these files you will have to update them. Please read the upgrade instructions for more information on the upgrade.

This release fixes the following issues:

Improve systemd to not output extra DEBUG logs.
Clicking on text to add VCL, Node and Parameter to Group not working.
Restarting a cluster is exposed via a refresh button.

References

Varnish High Availability 2.1.5

Mon, 06 Aug 2018 00:00:00 +0000

Due to a bug in certain libcurl versions, VHA can push HTTPS replications requests to the wrong nodes in the cluster, leaving others untouched. This version works around the issue by closing the connection after each HTTPS request.

On the other hand, plain HTTP requests now systematically request a connection keep-alive instead of inheriting the client request header.

We also added the -k argument allowing VHA to trust HTTPS nodes even if the certificate doesn’t match the host, or if the trust chain isn’t valid (same as curl -k), this makes testing your setup easier when using self-signed certificates, notably.

Varnish Administration Console 3.7.0

Thu, 28 Jun 2018 12:00:01 +0000

Varnish Administration Console (VAC) 3.7.0 has been updated to offer better user experiences to our customers. It is now fully responsive and has some various improvements to create a more modern look and layout. It also comes with the systemd compliant packages for CENTOS / RHEL 7.

We have also made some improvements on URL patterns to make it easy to access different pages. New introduced URL patterns are:

overview/realtime
overview/historical
overview/realtime?groupid=:ID
overview/historical?groupid=:ID
configure/vcl/:ID
configure/vcl/:ID/group/:ID
configure/parameters/:ID
configure/terminal/nodeID

Drag and drop to add Cache Node, VCL and Parameter Sets has been replaced by context menu. Adding and Removing the Nodes, VCL and Parameters will automatically be saved and Save changes button has been removed.

Varnish Cache Plus 4.1.10r4

Thu, 14 Jun 2018 12:00:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r4.

About the release

This release contains three bug fixes but is otherwise the same as 4.1.10r3. We encourage every user on 4.1 to upgrade to this version.

See the change log for details on this and previous releases.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Cache Plus 4.1.10r3

Wed, 06 Jun 2018 13:30:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r3.

About the release

This release is very similar to 4.1.10r2, with only a single bug fix added. We encourage every user on 4.1 to upgrade to this version.

See the change log for details on this and previous releases.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Cache Plus 4.1.10r2

Tue, 05 Jun 2018 08:00:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.10r2.

About the release

This release is very similar to 4.1.10r1, with only a few bug fixes. We encourage every user on 4.1 to upgrade to this version.

See the change log for details on this and previous releases.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Administration Console 3.6.2

Fri, 25 May 2018 12:30:01 +0000

This Varnish Administration Console (VAC) release fixes a purger bug where socket connections were not soaked across multiple requests.

References

Varnish Administration Console 3.6.1

Wed, 23 May 2018 15:50:01 +0000

This Varnish Administration Console (VAC) release fixes a purger bug where multiple requests on the same connection were not handled.

References

Varnish Cache Plus 4.1.10r1

Wed, 02 May 2018 08:00:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.9r3.

About the release

In addition to the usual bug fixes, you will find a new VMOD; URL Plus.

See the change log for a full list of bug fixes for this and previous versions.

References

Varnish Cache Plus changes
Varnish Cache changes backported to this release of Varnish Cache Plus
Upgrade notes

Varnish Custom Statistics 6.0.0

Tue, 27 Mar 2018 00:00:00 +0000

Varnish 6.0.0 support.
Renamed vcsprobe to vcs-agent
Rebranded from vstatd to VCS.
Move from mongoose to libmicrohttpd
Move to the VUT public API
Import option -K from vagent2
Try serving index.html for directory URLs
Don’t kill the VCS if the DNS is down.
Reject non GET methods.
The -a option does not include the IP address
IPv6 support without the dual stack mode
Proof of concept for simple /match requests
Dropping non-systemd support and environmentfiles.

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

Varnish Administration Console 3.6.0

Wed, 14 Mar 2018 11:00:01 +0000

This Varnish Administration Console (VAC) release addresses some known issues and adds some new functionalities.

This update is recommended for all users.

This release is compatible with the forthcoming Varnish Enterprise 6 through Varnish agent 6.

For the full set of changes check the VAC changelog.

References

Varnish Cache Plus 4.0.4r3

Mon, 12 Mar 2018 00:00:01 +0000

About the release

This release is a bug fixing release, with the following fixes:

Nonblocking handshake for fetch transactions.
Backport the fix of 1955.
Don’t test gunzip for partial responses.

This update is recommended for all users of 4.0.

Users should also consider upgrading further to 4.1.9r3, which includes performance enhancements and bug fixes not available in the 4.0 series.

Varnish Cache Plus 4.1.9r3

Mon, 26 Feb 2018 00:00:01 +0000

Important: If you are not running 4.1.9r1 (released November 30th) or newer, make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.9r3.

About the release

This release is primarily a bug fixing release, but it also contains some minor improvements:

The latest version of varnish-modules
New Edgestash multi JSON csv function
New counter: n_lru_limitied tells you how many times storage allocation have failed due to nuke_limit.

See the change log for a full list of bug fixes for this and previous versions.

Varnish High Availability 2.1.4

Mon, 29 Jan 2018 00:00:00 +0000

This release addresses an issue arising during VSL peak traffic, where the logger needs to prematurely flush transactions to keep track of things. This has been mitigated in version 2.1.4 by dropping truncated requests to guarantee replication faithfulness and to favor user traffic over replication requests.

References

Varnish High Availability 2.1.3

Mon, 15 Jan 2018 00:00:00 +0000

In the 2.1 series, due to a VSL parsing error, when an ESI subrequest containing an Accept-Encoding header is replicated, all headers are discarded and the Host header is set to the node IP. The release fixes the issue.

The 2.0 series, as well as the 2.0.0 release are not affected.

References

Varnish High Availability 2.1.2

Thu, 04 Jan 2018 00:00:00 +0000

This revision release increase compatibility with VCL hashing the Accept headers. Before, VHA automatically added an Accept header if none was present, which would cause replication issues for request without this header.

References

Varnish Discovery 1.0.0

Tue, 19 Dec 2017 10:00:00 +0000

Today we release a new tool: Varnish Discovery. It aims to streamline VHA’s configuration by automatically producing the nodes.conf file that it needs, making HA setups using VAC or Kubernetes super easy to deploy as each node can automatically discover its peers, and keep that knowledge up-to-date over time.

Configuration is minimal, and this initial supports the VAC, DNS and Kubernetes APIs.

References

Varnish Discovery documentation

Varnish Cache Plus 4.1.9r2

Tue, 19 Dec 2017 00:00:00 +0000

Important: If you are not running 4.1.9r1 now (released November 30th), make sure you read the associated information on upgrading to 4.1.9r1 before you upgrade to 4.1.9r2.

About the release

This release contains some updates to vmod_rewrite, a new counter and a few bug fixes.

The changes to vmod_rewrite are:

new feature: split find/match functions.
new feature: multiple replacements can be defined for one regex.
new parameters to control substitution: regsub, regsuball, only_matching
deprecation: for consistency .match_rewrite() should be used instead of .replace().

Bug fixes are the following:

Varnish Custom Statistics 4.1.5

Mon, 11 Dec 2017 00:00:00 +0000

This VCS release addresses several issues that where present in 4.1.4.

The full set of changes can be found on the changelog. We recommend you to upgrade to this release.

References

Varnish High Availability 2.1.1

Fri, 08 Dec 2017 00:00:00 +0000

This VHA release builds on the 2.1.0 that notably brought request body replication, replication prevention and header addition from the VCL. The biggest change with this version is the way ESI requests are handled. In earlier releases, only the top request was replicated, which led to some (harmless) warnings because the replicated status codes could differ from the original ones (200 vs 304). With 2.1.0, VHA replicates each fragment individually, reducing the noise and clearing out these warnings.

Varnish Cache Plus 4.1.9r1

Thu, 30 Nov 2017 00:00:00 +0000

This release increments the VMOD ABI version number, which means that VMODs will have to be recompiled in order to load. Packages for Varnish Cache Plus 4.1.9r1 and updated VMOD packages are available from our package repositories. Thirdparty VMODs will have to be recompiled manually.

Some other changes include:

Expose to VCL whether or not a fetch is a background fetch (bgfetch).
Fix retrying backend fetches over reused connections.
Fix rare resource leaking scenario related to an ESI delivery.
Ignore req.ttl when keeping track of expired objects.

Technical details of the VMOD ABI version bump

The Varnish Cache uses an in-tree implementation of SHA-256 to do hashing internally. These functions used the same names as the ones provided by OpenSSL’s libcrypto, and on some platforms (Debian in particular) this is causing problems where OpenSSL starts to use Varnish’ SHA-256 functions.

Varnish Cache data leak when using file stevedore with synthetic objects

Wed, 15 Nov 2017 10:00:00 +0000

Overview

A data leak can be triggered in Varnish Cache by a remote client if Varnish Cache is using the file stevedore for synthetic error objects and the backend does not respond properly or times out.

This was discovered and patched respectively by Carlo Cannas of Altervista.org and @shamger.

Impact

Potential impact is data leak and segmentation fault:

The data leaked will be an excerpt from the anonymously mapped memory of the varnishd process, limited upwards to 4k bytes and it will be present in the body of the synthesized error object created in place of the failed backend fetch.

Varnish HTTP Cache DoS vulnerability

Wed, 02 Aug 2017 10:00:00 +0000

Overview

An assert can be triggered in Varnish Cache and Varnish Enterprise by a remote client sending a specially crafted HTTP request. Varnish will panic and restart when the assert is triggered, which constitutes a denial of service attack.

This was discovered by StackPath.

Impact

The potential impact is reduced or completely lost availability.