CVE-2009-2936
HighPublic exploitThe Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code…
Published Apr 5, 2010 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2009-2936
Key Facts
Patch immediately- CVE-2009-2936 is a high-severity vulnerability (CVSS 7.5 v2) affecting Varnish (Varnish.projects.linpro), rootio-varnish.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 64% probability of exploitation in the next 30 days.
- Fixed versions are available, including rootio-varnish 2.1.0-2, Varnish 2.1.0-2.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS (30-day exploit likelihood)
64%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2009-2936 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set, stop, and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report, saying that it is "fundamentally misguided and pointless.
Affected Products
32 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| VarnishVarnish.projects.linpro | 0.9, 0.9.1, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1 | 2.1.0-2 |
| rootio-varnishrootio | See advisory | 2.1.0-2 |
Patched Releases
rootio-varnish
2.1.0-2
Varnish
2.1.0-2
Timeline
Publicly disclosed
Apr 5, 2010
Last updated
Aug 4, 2026
Weakness Type
- CWE-287 Improper Authentication
References
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2009-2936
- exploitExploitDB-35581
- otherFEDORA-2010-6719
- other20100329 Medium security hole in Varnish reverse proxy
- other20100329 Re: [Full-disclosure] Medium security hole in Varnish reverse proxy
FAQ
Common Questions.
The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port, which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provide…
Affected: Varnish (Varnish.projects.linpro) versions 0.9, 0.9.1, 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.1; rootio-varnish. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including rootio-varnish 2.1.0-2, Varnish 2.1.0-2.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2009-2936 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo