CVE-2026-34475

EUVD-2026-16801
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 20%
Affected Products (NVD)
VendorProductVersion
varnish-softwarevarnish_enterprise
𝑥
≤ 6.0.15
varnish-softwarevarnish_enterprise
6.0.16:r1
varnish-softwarevarnish_enterprise
6.0.16:r10
varnish-softwarevarnish_enterprise
6.0.16:r11
varnish-softwarevarnish_enterprise
6.0.16:r2
varnish-softwarevarnish_enterprise
6.0.16:r3
varnish-softwarevarnish_enterprise
6.0.16:r4
varnish-softwarevarnish_enterprise
6.0.16:r5
varnish-softwarevarnish_enterprise
6.0.16:r6
varnish-softwarevarnish_enterprise
6.0.16:r7
varnish-softwarevarnish_enterprise
6.0.16:r8
varnish-softwarevarnish_enterprise
6.0.16:r9
vinyl-cachevinyl_cache
𝑥
< 8.0.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
varnish
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Common Weakness Enumeration
References
https://vinyl-cache.org/security/VSV00018.html