Version in base suite: 7.7.0-3+deb13u1 Base version: varnish_7.7.0-3+deb13u1 Target version: varnish_7.7.0-3+deb13u2 Base file: /srv/ftp-master.debian.org/ftp/pool/main/v/varnish/varnish_7.7.0-3+deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/v/varnish/varnish_7.7.0-3+deb13u2.dsc changelog | 12 ++ patches/fix_vsv18_1 | 87 ++++++++++++++++ patches/fix_vsv18_2 | 50 +++++++++ patches/fix_vsv18_3 | 271 ++++++++++++++++++++++++++++++++++++++++++++++++++++ patches/fix_vsv18_4 | 48 +++++++++ patches/fix_vsv18_5 | 105 ++++++++++++++++++++ patches/fix_vsv20 | 51 +++++++++ patches/series | 6 + 8 files changed, 630 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpoifjq4gk/varnish_7.7.0-3+deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpoifjq4gk/varnish_7.7.0-3+deb13u2.dsc: no acceptable signature found diff -Nru varnish-7.7.0/debian/changelog varnish-7.7.0/debian/changelog --- varnish-7.7.0/debian/changelog 2026-05-24 22:57:57.000000000 +0000 +++ varnish-7.7.0/debian/changelog 2026-10-24 10:03:52.000000000 +0000 @@ -1,3 +1,15 @@ +varnish (7.7.0-3+deb13u2) trixie-security; urgency=medium + + * Non-maintainer upload by the Security Team. + * Backport the VSV00020 case-conversion workspace overflow fix + (CVE-2026-93894), with regression tests. + * Backport the complete VSV00018 absolute-form request normalization + fix (CVE-2026-34475): validate request URLs, enable HTTPS + normalization by default while preserving opt-out, and cover empty + paths and query-only targets. + + -- Aron Xu Sat, 24 Oct 2026 18:03:52 +0800 + varnish (7.7.0-3+deb13u1) trixie-security; urgency=medium * Backport the fix for the VSV00019 request smuggling vulnerability. diff -Nru varnish-7.7.0/debian/patches/fix_vsv18_1 varnish-7.7.0/debian/patches/fix_vsv18_1 --- varnish-7.7.0/debian/patches/fix_vsv18_1 1970-01-01 00:00:00.000000000 +0000 +++ varnish-7.7.0/debian/patches/fix_vsv18_1 2026-10-24 09:51:38.000000000 +0000 @@ -0,0 +1,87 @@ +Description: Normalize absolute-form requests with an empty path (VSV00018) + . + Backport to 7.7: retain http_method_eq and the stable method API. + Adapt the upstream r01255 cases without newer logging/counter assertions; + use pass to avoid cached responses masking individual parser outcomes. +Author: Nils Goroll +Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/73dcb85eb8ad9fa9b462c5477d8c4b5061f615de +Bug: https://vinyl-cache.org/security/VSV00018.html +Forwarded: not-needed +Last-Update: 2026-10-23 + +--- a/bin/varnishd/http1/cache_http1_proto.c ++++ b/bin/varnishd/http1/cache_http1_proto.c +@@ -375,10 +375,16 @@ + b = hp->hd[HTTP_HDR_URL].b + 8; + if (b) { + e = strchr(b, '/'); +- if (e) { +- http_Unset(hp, H_Host); +- http_PrintfHeader(hp, "Host: %.*s", (int)(e - b), b); +- hp->hd[HTTP_HDR_URL].b = e; ++ if (e == NULL) ++ e = hp->hd[HTTP_HDR_URL].e; ++ http_Unset(hp, H_Host); ++ http_PrintfHeader(hp, "Host: %.*s", (int)(e - b), b); ++ hp->hd[HTTP_HDR_URL].b = e; ++ if (Tlen(hp->hd[HTTP_HDR_URL]) == 0) { ++ if (http_method_eq(http_GetMethod(hp), OPTIONS)) ++ hp->hd[HTTP_HDR_URL] = Tstr("*"); ++ else ++ hp->hd[HTTP_HDR_URL] = Tstr("/"); + } + } + +--- a/bin/varnishtest/tests/r01255.vtc ++++ b/bin/varnishtest/tests/r01255.vtc +@@ -1,19 +1,46 @@ +-varnishtest "Test RFC2616 5.2 compliance" ++varnishtest "Test RFC9112 3.2 compliance" + +-server s1 { ++server s1 -repeat 6 { + rxreq + txresp -hdr "Foo: 1" + } -start + + varnish v1 -vcl+backend { +- ++ sub vcl_recv { return (pass); } + sub vcl_deliver { + set resp.http.rxhost = req.http.host; ++ set resp.http.url = req.url; + } + } -start + + client c1 { +- txreq -url http://www.example.com/bar ++ txreq -url http://www.example.com/bar -hdr "host: another" + rxresp + expect resp.http.rxhost == www.example.com ++ expect resp.http.url == /bar ++ ++ txreq -url http://www.example.com/ -hdr "host: another" ++ rxresp ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == / ++ ++ txreq -url http://www.example.com -hdr "host: another" ++ rxresp ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == / ++ ++ txreq -method OPTIONS -url http://www.example.com -hdr "host: another" ++ rxresp ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == * ++ ++ txreq -url http:///bar -hdr "host: another" ++ rxresp ++ expect resp.http.rxhost == "" ++ expect resp.http.url == /bar ++ ++ txreq -url http:// -hdr "host: another" ++ rxresp ++ expect resp.http.rxhost == "" ++ expect resp.http.url == / + } -run diff -Nru varnish-7.7.0/debian/patches/fix_vsv18_2 varnish-7.7.0/debian/patches/fix_vsv18_2 --- varnish-7.7.0/debian/patches/fix_vsv18_2 1970-01-01 00:00:00.000000000 +0000 +++ varnish-7.7.0/debian/patches/fix_vsv18_2 2026-10-23 06:22:36.000000000 +0000 @@ -0,0 +1,50 @@ +Description: Reject empty absolute-form authority (VSV00018) + . + Backport runtime change unchanged; adapt the existing stable parser test. + The rejected request closes its connection, so use a separate client. +Author: Nils Goroll +Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/5c016b070e1994fd8a430b45dac7dc3ee63f04d7 +Bug: https://vinyl-cache.org/security/VSV00018.html +Forwarded: not-needed +Last-Update: 2026-10-23 + +--- a/bin/varnishd/http1/cache_http1_proto.c ++++ b/bin/varnishd/http1/cache_http1_proto.c +@@ -377,6 +377,10 @@ + e = strchr(b, '/'); + if (e == NULL) + e = hp->hd[HTTP_HDR_URL].e; ++ if (e == b) { ++ // rfc9110 4.2.1 4.2.2 reject empty host ++ return (400); ++ } + http_Unset(hp, H_Host); + http_PrintfHeader(hp, "Host: %.*s", (int)(e - b), b); + hp->hd[HTTP_HDR_URL].b = e; +--- a/bin/varnishtest/tests/r01255.vtc ++++ b/bin/varnishtest/tests/r01255.vtc +@@ -1,6 +1,6 @@ + varnishtest "Test RFC9112 3.2 compliance" + +-server s1 -repeat 6 { ++server s1 -repeat 4 { + rxreq + txresp -hdr "Foo: 1" + } -start +@@ -36,11 +36,12 @@ + + txreq -url http:///bar -hdr "host: another" + rxresp +- expect resp.http.rxhost == "" +- expect resp.http.url == /bar ++ expect resp.status == 400 ++} -run ++ ++client c2 { + + txreq -url http:// -hdr "host: another" + rxresp +- expect resp.http.rxhost == "" +- expect resp.http.url == / ++ expect resp.status == 400 + } -run diff -Nru varnish-7.7.0/debian/patches/fix_vsv18_3 varnish-7.7.0/debian/patches/fix_vsv18_3 --- varnish-7.7.0/debian/patches/fix_vsv18_3 1970-01-01 00:00:00.000000000 +0000 +++ varnish-7.7.0/debian/patches/fix_vsv18_3 2026-10-23 06:22:36.000000000 +0000 @@ -0,0 +1,271 @@ +Description: VSV00018: defend request URLs in built-in VCL + . + Backport to 7.7 without new counters, logging tags or method APIs. + Retain stable CONNECT pipe policy; omit unrelated release notes. +Author: Nils Goroll +Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/f89df57ab8e30ca5c8d04ba27870d473f17bedd4 +Bug: https://vinyl-cache.org/security/VSV00018.html +Forwarded: not-needed +Last-Update: 2026-10-23 + +Index: varnish-7.7.0/bin/varnishd/builtin.vcl +=================================================================== +--- varnish-7.7.0.orig/bin/varnishd/builtin.vcl ++++ varnish-7.7.0/bin/varnishd/builtin.vcl +@@ -41,6 +41,7 @@ sub vcl_recv { + } + + sub vcl_builtin_recv { ++ call vcl_req_url; + call vcl_req_host; + call vcl_req_method; + call vcl_req_authorization; +@@ -58,6 +59,16 @@ sub vcl_req_host { + return (synth(400)); + } + } ++ ++sub vcl_req_url { ++ if (req.url == "*" && req.method == "OPTIONS") { ++ return; ++ } ++ # CONNECT retains the stable vcl_req_method pipe policy. ++ if (req.url !~ "^/" && req.method != "CONNECT") { ++ return (synth(400)); ++ } ++} + + sub vcl_req_method { + if (req.method == "PRI") { +Index: varnish-7.7.0/bin/varnishtest/tests/b00026.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/b00026.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/b00026.vtc +@@ -2,13 +2,13 @@ varnishtest "Check the precedence for ti + + server s1 { + rxreq +- expect req.url == "from_backend" ++ expect req.url == "/from_backend" + delay 1 + txresp + } -start + server s2 { + rxreq +- expect req.url == "from_vcl" ++ expect req.url == "/from_vcl" + delay 1.5 + txresp + } -start +@@ -26,13 +26,13 @@ varnish v1 -vcl { + } + + sub vcl_recv { +- if (req.url == "from_backend") { ++ if (req.url == "/from_backend") { + return(pass); + } + } + sub vcl_backend_fetch { + set bereq.first_byte_timeout = 2s; +- if (bereq.url == "from_backend") { ++ if (bereq.url == "/from_backend") { + set bereq.backend = b1; + } else { + set bereq.backend = b2; +@@ -42,10 +42,10 @@ varnish v1 -vcl { + varnish v1 -cliok "param.set first_byte_timeout 0.5" + + client c1 { +- txreq -url "from_backend" ++ txreq -url "/from_backend" + rxresp + expect resp.status == 200 +- txreq -url "from_vcl" ++ txreq -url "/from_vcl" + rxresp + expect resp.status == 200 + } -run +Index: varnish-7.7.0/bin/varnishtest/tests/c00005.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/c00005.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/c00005.vtc +@@ -5,7 +5,7 @@ server s1 { + expect req.url == "/" + txresp -body "1111\n" + rxreq +- expect req.url == "foo" ++ expect req.url == "/foo" + txresp -body "2222\n" + } -start + +@@ -40,7 +40,7 @@ varnish v1 -vcl+backend { + } -start + + client c1 { +- txreq -url "foo" ++ txreq -url "/foo" + rxresp + expect resp.status == 200 + expect resp.http.acl == acl1 +Index: varnish-7.7.0/bin/varnishtest/tests/e00009.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/e00009.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/e00009.vtc +@@ -40,7 +40,7 @@ varnish v1 -expect MAIN.s_resp_bodybytes + varnish v1 -cli "param.set feature +esi_disable_xml_check" + + client c1 { +- txreq -url bar ++ txreq -url /bar + rxresp + expect resp.status == 200 + expect resp.bodylen == 22 +Index: varnish-7.7.0/bin/varnishtest/tests/e00019.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/e00019.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/e00019.vtc +@@ -34,19 +34,19 @@ server s1 { + # Varnish 4 + server s2 { + rxreq +- expect req.url == "bar/foo" ++ expect req.url == "/foo" + txresp -body {} + } -start + + varnish v1 -vcl+backend { + sub vcl_backend_fetch { +- if (bereq.url != "bar") { ++ if (bereq.url != "/bar") { + set bereq.backend = s2; + } + } + + sub vcl_backend_response { +- if (bereq.url == "bar") { ++ if (bereq.url == "/bar") { + set beresp.do_esi = true; + } + } +@@ -67,7 +67,7 @@ logexpect l1 -v v1 -g vxid -q "vxid == 1 + } -start + + client c1 { +- txreq -url bar ++ txreq -url /bar + rxresp + expect resp.status == 200 + expect resp.bodylen == 65856 +Index: varnish-7.7.0/bin/varnishtest/tests/r01847.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/r01847.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/r01847.vtc +@@ -26,8 +26,7 @@ client c1 { + + txreq -url https://www.example.com/bar + rxresp +- expect resp.http.rxhost == "${localhost}" +- expect resp.http.rxurl == https://www.example.com/bar ++ expect resp.status == 400 + } -run + + varnish v1 -cliok "param.set feature +https_scheme" +Index: varnish-7.7.0/bin/varnishtest/tests/r02339.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/r02339.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/r02339.vtc +@@ -11,10 +11,10 @@ varnish v1 -vcl+backend { + import purge; + + sub vcl_miss { +- if (req.url == "miss") { purge.hard(); } ++ if (req.url == "/miss") { purge.hard(); } + } + sub vcl_hit { +- if (req.url == "hit") { purge.hard(); } ++ if (req.url == "/hit") { purge.hard(); } + } + } -start + +@@ -39,15 +39,15 @@ logexpect l1 -v v1 { + } -start + + client c1 { +- txreq -url hit ++ txreq -url /hit + rxresp + expect resp.status == 200 + +- txreq -url hit ++ txreq -url /hit + rxresp + expect resp.status == 200 + +- txreq -url miss ++ txreq -url /miss + rxresp + expect resp.status == 200 + } -run +@@ -59,7 +59,7 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_purge { +- if (req.url == "purge") { purge.hard(); } ++ if (req.url == "/purge") { purge.hard(); } + } + } + +@@ -67,7 +67,7 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_pass { +- if (req.url == "pass") { purge.hard(); } ++ if (req.url == "/pass") { purge.hard(); } + } + } + +@@ -75,7 +75,7 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_deliver { +- if (req.url == "deliver") { purge.hard(); } ++ if (req.url == "/deliver") { purge.hard(); } + } + } + +@@ -83,7 +83,7 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_synth { +- if (req.url == "synth") { purge.hard(); } ++ if (req.url == "/synth") { purge.hard(); } + } + } + +@@ -91,7 +91,7 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_backend_fetch { +- if (bereq.url == "fetch") { purge.hard(); } ++ if (bereq.url == "/fetch") { purge.hard(); } + } + } + +@@ -99,7 +99,7 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_backend_error { +- if (bereq.url == "error") { purge.hard(); } ++ if (bereq.url == "/error") { purge.hard(); } + } + } + +@@ -107,6 +107,6 @@ varnish v1 -errvcl "Not available in sub + import purge; + + sub vcl_backend_response { +- if (bereq.url == "response") { purge.hard(); } ++ if (bereq.url == "/response") { purge.hard(); } + } + } diff -Nru varnish-7.7.0/debian/patches/fix_vsv18_4 varnish-7.7.0/debian/patches/fix_vsv18_4 --- varnish-7.7.0/debian/patches/fix_vsv18_4 1970-01-01 00:00:00.000000000 +0000 +++ varnish-7.7.0/debian/patches/fix_vsv18_4 2026-10-23 06:22:36.000000000 +0000 @@ -0,0 +1,48 @@ +Description: VSV00018: enable HTTPS normalization by default, retaining opt-out + . + Backport to 7.7 without new counters, logging tags or method APIs. + Retain stable CONNECT pipe policy; omit unrelated release notes. +Author: Nils Goroll +Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/e8eccd46514e4b4f7ee5d970ee08a4e5a59586b8 +Bug: https://vinyl-cache.org/security/VSV00018.html +Forwarded: not-needed +Last-Update: 2026-10-23 + +diff --git a/bin/varnishtest/tests/r01847.vtc b/bin/varnishtest/tests/r01847.vtc +index 6002b9e098..d82da1e0cc 100644 +--- a/bin/varnishtest/tests/r01847.vtc ++++ b/bin/varnishtest/tests/r01847.vtc +@@ -26,10 +26,11 @@ client c1 { + + txreq -url https://www.example.com/bar + rxresp +- expect resp.status == 400 ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.rxurl == /bar + } -run + +-varnish v1 -cliok "param.set feature +https_scheme" ++varnish v1 -cliok "param.set feature -https_scheme" + + client c1 { + txreq -url http://www.example.com/bar +@@ -39,6 +40,5 @@ client c1 { + + txreq -url https://www.example.com/bar + rxresp +- expect resp.http.rxhost == www.example.com +- expect resp.http.rxurl == /bar ++ expect resp.status == 400 + } -run +diff --git a/include/tbl/params.h b/include/tbl/params.h +index c94f771d59..bdb34e085b 100644 +--- a/include/tbl/params.h ++++ b/include/tbl/params.h +@@ -1987,6 +1987,7 @@ PARAM_BITS( + /* fld */ feature_bits, + /* def */ + "none," ++ "+https_scheme," + "+validate_headers," + "+vcl_req_reset", + /* descr */ diff -Nru varnish-7.7.0/debian/patches/fix_vsv18_5 varnish-7.7.0/debian/patches/fix_vsv18_5 --- varnish-7.7.0/debian/patches/fix_vsv18_5 1970-01-01 00:00:00.000000000 +0000 +++ varnish-7.7.0/debian/patches/fix_vsv18_5 2026-10-23 06:22:36.000000000 +0000 @@ -0,0 +1,105 @@ +Description: VSV00018: normalize query-only absolute-form paths + . + Backport parser logic without the new counter; preserve http_method_eq. + Extend downstream stable tests for HTTP/HTTPS, conflicting Host and query-only + paths. Drop the old r01847 backend expectation for unnormalized HTTPS which + is now rejected by the URL guard when https_scheme is explicitly disabled. +Author: Nils Goroll +Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/613b6f6a3b5ef35df0ab5139310f4944bf1adf58 +Bug: https://vinyl-cache.org/security/VSV00018.html +Forwarded: not-needed +Last-Update: 2026-10-23 + +Index: varnish-7.7.0/bin/varnishd/http1/cache_http1_proto.c +=================================================================== +--- varnish-7.7.0.orig/bin/varnishd/http1/cache_http1_proto.c ++++ varnish-7.7.0/bin/varnishd/http1/cache_http1_proto.c +@@ -355,6 +355,7 @@ HTTP1_DissectRequest(struct http_conn *h + uint16_t retval; + const char *p; + const char *b = NULL, *e; ++ char c = '\0'; + + CHECK_OBJ_NOTNULL(htc, HTTP_CONN_MAGIC); + CHECK_OBJ_NOTNULL(hp, HTTP_MAGIC); +@@ -374,9 +375,11 @@ HTTP1_DissectRequest(struct http_conn *h + http_scheme_at(hp->hd[HTTP_HDR_URL].b, https)) + b = hp->hd[HTTP_HDR_URL].b + 8; + if (b) { +- e = strchr(b, '/'); ++ e = strpbrk(b, "/?"); + if (e == NULL) + e = hp->hd[HTTP_HDR_URL].e; ++ else ++ c = *e; + if (e == b) { + // rfc9110 4.2.1 4.2.2 reject empty host + return (400); +@@ -389,6 +392,10 @@ HTTP1_DissectRequest(struct http_conn *h + hp->hd[HTTP_HDR_URL] = Tstr("*"); + else + hp->hd[HTTP_HDR_URL] = Tstr("/"); ++ } else if (c == '?') { ++ hp->hd[HTTP_HDR_URL].b--; ++ char *t = TRUST_ME(hp->hd[HTTP_HDR_URL].b); ++ *t = '/'; + } + } + +Index: varnish-7.7.0/bin/varnishtest/tests/r01255.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/r01255.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/r01255.vtc +@@ -1,6 +1,6 @@ + varnishtest "Test RFC9112 3.2 compliance" + +-server s1 -repeat 4 { ++server s1 -repeat 8 { + rxreq + txresp -hdr "Foo: 1" + } -start +@@ -34,6 +34,30 @@ client c1 { + expect resp.http.rxhost == www.example.com + expect resp.http.url == * + ++ txreq -url https://www.example.com -hdr "host: another" ++ rxresp ++ expect resp.status == 200 ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == / ++ ++ txreq -url http://www.example.com?/foo -hdr "host: another" ++ rxresp ++ expect resp.status == 200 ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == /?/foo ++ ++ txreq -url https://www.example.com?/foo -hdr "host: another" ++ rxresp ++ expect resp.status == 200 ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == /?/foo ++ ++ txreq -url https://www.example.com/?a=b -hdr "host: another" ++ rxresp ++ expect resp.status == 200 ++ expect resp.http.rxhost == www.example.com ++ expect resp.http.url == /?a=b ++ + txreq -url http:///bar -hdr "host: another" + rxresp + expect resp.status == 400 +Index: varnish-7.7.0/bin/varnishtest/tests/r01847.vtc +=================================================================== +--- varnish-7.7.0.orig/bin/varnishtest/tests/r01847.vtc ++++ varnish-7.7.0/bin/varnishtest/tests/r01847.vtc +@@ -5,9 +5,6 @@ server s1 { + expect req.url == /bar + txresp + +- rxreq +- expect req.url == https://www.example.com/bar +- txresp + } -start + + varnish v1 -vcl+backend { diff -Nru varnish-7.7.0/debian/patches/fix_vsv20 varnish-7.7.0/debian/patches/fix_vsv20 --- varnish-7.7.0/debian/patches/fix_vsv20 1970-01-01 00:00:00.000000000 +0000 +++ varnish-7.7.0/debian/patches/fix_vsv20 2026-10-24 09:49:17.000000000 +0000 @@ -0,0 +1,51 @@ +Description: Check workspace bounds before case conversion writes (VSV00020) +Author: Walid Boudebouda +Origin: https://code.vinyl-cache.org/vinyl-cache/vinyl-cache/commit/853d397f30753bce1587991fcf9193c63fb4d1eb +Bug: https://vinyl-cache.org/security/VSV00020.html +Forwarded: not-needed +Last-Update: 2026-10-23 + . + Backport to 7.7 by adapting bin/vinyld to bin/varnishd. Retain the + stable AN(s) check. + +Index: varnish-7.7.0/bin/varnishd/cache/cache_vrt.c +=================================================================== +--- varnish-7.7.0.orig/bin/varnishd/cache/cache_vrt.c ++++ varnish-7.7.0/bin/varnishd/cache/cache_vrt.c +@@ -497,7 +497,7 @@ VRT_UpperLowerStrands(VRT_CTX, VCL_STRAN + unsigned u; + char *b, *e, *r; + const char *p, *q = NULL; +- int i, copy = 0; ++ int i, copy = 0, op = 0; + + CHECK_OBJ_NOTNULL(ctx, VRT_CTX_MAGIC); + CHECK_OBJ_NOTNULL(ctx->ws, WS_MAGIC); +@@ -511,15 +511,20 @@ VRT_UpperLowerStrands(VRT_CTX, VCL_STRAN + if (q != NULL) + copy = 1; + for(p = q = s->p[i]; *p != '\0'; p++) { +- if ((up && vct_islower(*p)) || +- (!up && vct_isupper(*p))) { +- *b++ = *p ^ 0x20; ++ op = up ? vct_islower(*p) : vct_isupper(*p); ++ ++ if (op) + copy = 1; +- } else if (b < e) { +- *b++ = *p; +- } +- if (copy && b == e) ++ ++ if (!copy && b == e) ++ continue; ++ else if (b == e) + break; ++ ++ if (op) ++ *b++ = *p ^ 0x20; ++ else ++ *b++ = *p; + } + if (copy && b == e) { + WS_Release(ctx->ws, 0); diff -Nru varnish-7.7.0/debian/patches/series varnish-7.7.0/debian/patches/series --- varnish-7.7.0/debian/patches/series 2026-05-24 22:57:57.000000000 +0000 +++ varnish-7.7.0/debian/patches/series 2026-10-24 09:48:30.000000000 +0000 @@ -7,3 +7,9 @@ fix_vsv17_4 fix_vsv17_5 fix_vsv19 +fix_vsv20 +fix_vsv18_1 +fix_vsv18_2 +fix_vsv18_3 +fix_vsv18_4 +fix_vsv18_5