CVE-2019-20637: An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6.2.x before 6.2.2, and 6.3.x before 6...

Security readout for executives and security teams

Varnish Cache could accidentally expose leftover internal request data when handling multiple requests on the same client connection. The disclosed data may include temporary headers or request-related structures. This is an information disclosure issue, not a confirmed remote code execution issue in the provided sources. Exposure is most likely where affected Varnish Cache versions front web applications or APIs and process repeated client requests over persistent connections. The source bundle does not identify specific downstream products or packaged versions beyond Varnish and openSUSE advisories. Treat this as a medium-priority confidentiality risk for environments using Varnish at the web edge. Patch during the next security maintenance window, sooner for authenticated or sensitive services. There is no provided evidence of active exploitation. Mitigation focus: Upgrade Varnish Cache to 6.0.5 LTS, 6.2.2, 6.3.1, or a later fixed release.; Apply relevant distribution security updates, including the referenced openSUSE advisories where applicable.; Prioritize internet-facing Varnish deployments and systems fronting authenticated applications or APIs..

Prepared

Jun 5, 2026, 15:17 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.