CVE-2026-34475
published 2026-03-27CVE-2026-34475: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.21%
11.1th percentile
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | varnish | — | — |
| varnish-software | varnish_cache | < 6.0.17 LTS | 6.0.17 LTS |
| varnish-software | varnish_cache | >= 7.0.0 < 8.0.1 | 8.0.1 |
| varnish-software | varnish_enterprise | <= 6.0.15 | — |
| varnish-software | varnish_enterprise | — | — |
| vinyl-cache | vinyl_cache | < 8.0.1 | 8.0.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for HTTP/1.1 requests where req.url contains a path of exactly '/' that may be used to trigger cache poisoning or authentication bypass in Varnish Cache/Enterprise ↗
- →Audit VCL configurations for any code paths where req.url is not explicitly validated or sanitized before being used in cache key construction or access control decisions ↗
- ·Varnish Cache versions before 8.0.1 are vulnerable; upgrade to 8.0.1 or later to remediate ↗
- ·Varnish Enterprise versions before 6.0.16r12 are vulnerable; upgrade to 6.0.16r12 or later to remediate ↗
- ·Red Hat Enterprise Linux 9 varnish package is marked Not affected, but varnish-modules on RHEL 9 has fix deferred — treat RHEL 8 varnish:6/varnish and RHEL 10 varnish packages as vulnerable pending fixes ↗
- ·The vulnerability is only triggered in 'unchecked req.url scenarios' — deployments that explicitly validate req.url in VCL before use may not be exposed ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv5.4MEDIUM
vendor_debian5.4MEDIUM
vendor_redhat5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m9gq-cmcj-p62x: Varnish Cache before 8
ghsa_unreviewed·2026-03-27
CVE-2026-34475 [MEDIUM] CWE-180 GHSA-m9gq-cmcj-p62x: Varnish Cache before 8
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
OSV
CVE-2026-34475: Varnish Cache before 8
osv·2026-03-27·CVSS 5.4
CVE-2026-34475 [MEDIUM] CVE-2026-34475: Varnish Cache before 8
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Red Hat
Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
vendor_redhat·2026-03-27·CVSS 5.4
CVE-2026-34475 [MEDIUM] CWE-1286 Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
A flaw was found in Varnish Cache and Varnish Enterprise. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/1.1 requests with a path of `/` in the URL. This mishandling of URLs, specifically in unchecked `req.url` scenarios, could lead to cache poisoning, where an attacker manipulates cached content, or an authentication bypass, allowing unauthorized access.
Package: redhat-user-workloads/varnish-7-10-0 (Red Hat Enter
Debian
CVE-2026-34475: varnish - Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain u...
vendor_debian·2026·CVSS 5.4
CVE-2026-34475 [MEDIUM] CVE-2026-34475: varnish - Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain u...
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-34475 Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
bugzilla·2026-03-27·CVSS 9.8
CVE-2026-34475 [CRITICAL] CVE-2026-34475 Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
CVE-2026-34475 Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Wiz
CVE-2026-34475 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.4
CVE-2026-34475 [MEDIUM] CVE-2026-34475 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-34475 :
Linux Debian vulnerability analysis and mitigation
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Source : NVD
## 5.4
Score
Published March 27, 2026
Severity MEDIUM
CNA Score 5.4
Affected Technologies
Linux Debian
Linux Red Hat
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 13.4
Exploitation Probability (EPSS) N/A
Affected packages and libraries
varnish:6::varnish-devel
varnish-docs
Sources
NVD
Debian 11, 12, 13, 14 Severity MEDIUM No Fix Added at: Mar 29, 2026
Echo Severity MEDIUM No Fi
2026-03-27
Published