CVE-2021-36740

Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST request. This affects Varnish Enterprise 6.0.x before 6.0.8r3, and Varnish Cache 5.x and 6.x before 6.5.2, 6.6.x before 6.6.1, and 6.0 LTS before 6.0.8.

• CWE-444

• https://docs.varnish-software.com/security/VSV00007/Mitigation, Vendor Advisory
• https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683bePatch, Third Party Advisory
• https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cfPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK/
• https://varnish-cache.org/security/VSV00007.htmlMitigation, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5088Third Party Advisory
• https://docs.varnish-software.com/security/VSV00007/Mitigation, Vendor Advisory
• https://github.com/varnishcache/varnish-cache/commit/82b0a629f60136e76112c6f2c6372cce77b683bePatch, Third Party Advisory
• https://github.com/varnishcache/varnish-cache/commit/9be22198e258d0e7a5c41f4291792214a29405cfPatch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/THV2DQA2GS65HUCKK4KSD2XLN3AAQ2V5/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBNLDEOTGYRIEQZBWV7F6VPYS4O2AAK/
• https://varnish-cache.org/security/VSV00007.htmlMitigation, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5088Third Party Advisory

Published

Jul 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36735Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36736Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36737The input fields of the Apache Pluto UrlTestPortlet are vuln…6.1
• CVE-2021-36738The input fields in the JSP version of the Apache Pluto Appl…6.1
• CVE-2021-36739The "first name" and "last name" fields of the Apache Pluto …6.1
• CVE-2021-3674A flaw was found in rizin. The create_section_from_phdr func…7.8
• CVE-2021-36741An improper input validation vulnerability in Trend Micro Ap…8.8
• CVE-2021-36742A improper input validation vulnerability in Trend Micro Ape…7.8
• CVE-2021-36744Trend Micro Security (Consumer) 2021 and 2020 are vulnerable…7.8
• CVE-2021-36745A vulnerability in Trend Micro ServerProtect for Storage 6.0…9.8
• CVE-2021-36746Blackboard Learn through 9.1 allows XSS by an authenticated …5.4
• CVE-2021-36747Blackboard Learn through 9.1 allows XSS by an authenticated …5.4