CVE-2017-12425

An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2. A wrong if statement in the varnishd source code means that particular invalid requests from the client can trigger an assert, related to an Integer Overflow. This causes the varnishd worker process to abort and restart, losing the cached contents in the process. An attacker can therefore crash the varnishd worker process on demand and effectively keep it from serving content - a Denial-of-Service attack. The specific source-code filename containing the incorrect statement varies across releases.

• CWE-190

• http://www.debian.org/security/2017/dsa-3924
• https://bugzilla.redhat.com/show_bug.cgi?id=1477222Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1051917Issue Tracking, Third Party Advisory
• https://github.com/varnishcache/varnish-cache/issues/2379Third Party Advisory
• https://lists.debian.org/debian-security-announce/2017/msg00186.htmlMailing List, Third Party Advisory
• https://www.varnish-cache.org/security/VSV00001.html#vsv00001Vendor Advisory
• http://www.debian.org/security/2017/dsa-3924
• https://bugzilla.redhat.com/show_bug.cgi?id=1477222Issue Tracking, Third Party Advisory
• https://bugzilla.suse.com/show_bug.cgi?id=1051917Issue Tracking, Third Party Advisory
• https://github.com/varnishcache/varnish-cache/issues/2379Third Party Advisory
• https://lists.debian.org/debian-security-announce/2017/msg00186.htmlMailing List, Third Party Advisory
• https://www.varnish-cache.org/security/VSV00001.html#vsv00001Vendor Advisory

Published

Aug 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1242IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vu…5.4
• CVE-2017-12420Heap-based buffer overflow in the SMB implementation in NetA…
• CVE-2017-12421NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows rem…
• CVE-2017-12422NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x b…
• CVE-2017-12423NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows rem…
• CVE-2017-12424In shadow before 4.5, the newusers tool could be made to man…9.8
• CVE-2017-12426GitLab Community Edition (CE) and Enterprise Edition (EE) be…
• CVE-2017-12427The ProcessMSLScript function in coders/msl.c in ImageMagick…
• CVE-2017-12428In ImageMagick 7.0.6-1, a memory leak vulnerability was foun…
• CVE-2017-12429In ImageMagick 7.0.6-1, a memory exhaustion vulnerability wa…
• CVE-2017-12430In ImageMagick 7.0.6-1, a memory exhaustion vulnerability wa…
• CVE-2017-12431In ImageMagick 7.0.6-1, a use-after-free vulnerability was f…