CVE-2023-41104 Memory corruption in n/a
Out-of-bounds memory access in libvmod-digest allows authentication bypass and information disclosure depending on VCL configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-41104?
CVE-2023-41104 is a medium-severity memory corruption vulnerability in n/a, published on 23 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading to both authentication bypass and information disclosure; however, the exact attack surface will depend on the particular VCL (Varnish Configuration Language) configuration in use.
Weakness: CWE-119
Which versions are affected by CVE-2023-41104?
It affects 2 products.
Products include Varnish-Software Varnish Enterprise, Varnish-Software Vmod Digest.
How do I fix CVE-2023-41104?
No fix has been published for CVE-2023-41104 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-41104 being exploited?
There is no known exploitation of CVE-2023-41104 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-34475 Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of /
- CVE-2025-30346 Other in Varnish Cache
- CVE-2026-40394 Denial of service in Varnish Cache
- CVE-2026-40395 Denial of service in Varnish Enterprise
- CVE-2025-30347 Information disclosure in Varnish Enterprise
Sources
Also known as GHSA-rrpc-jfj4-37w9.