Every CVE Search/ Get API key

CVE-2026-34475

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url...

5.4 MediumFix available

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.21%Up 0.2 points since Mar 28, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.4

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Record
CVE-2026-34475
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-180
Updated
2026-11-02
EUVDEUVD-2026-16801 5.4

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Record
EUVD-2026-16801
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-m9gq-cmcj-p62x 5.4

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url...

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Record
GHSA-m9gq-cmcj-p62x
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-180
Updated
2026-11-02
NVD 5.4

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Record
CVE-2026-34475
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-180
Updated
2026-11-02
OSVDEBIAN-CVE-2026-34475 9.8

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Record
DEBIAN-CVE-2026-34475
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2026-2677 9.8

varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.

Security Fix(es):

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.(CVE-2026-34475)

Record
OESA-2026-2677
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2026-3045 9.8

varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.

Security Fix(es):

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.(CVE-2026-34475)

Record
OESA-2026-3045
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-34475 9.8

CVE-2026-34475 in varnish - Patched by Root

Root has patched CVE-2026-34475 in the varnish package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-34475
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-34475 9.8

CVE-2026-34475 in varnish - Patched by Root

Root has patched CVE-2026-34475 in the varnish package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-34475
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-34475 5.4

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Record
UBUNTU-CVE-2026-34475
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2026-0357 No score

Updated varnish packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass. (CVE-2026-34475) In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency in HTTP/2 request parsing can be exploited to launch a backend request desync attack (request smuggling), which in turn can be used for cache poisoning, authentication bypass, or possibly even information disclosure and manipulation. The attack vector only exists if HTTP/2 support is enabled by setting the feature parameter to contain +http2. HTTP/2 support is disabled by default. (CVE-2026-50052)

Record
MGASA-2026-0357
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
varnish
Debian:12
 All versions, plus listed versions
7.1.1-1.17.1.1-1.1+deb12u17.1.1-1.27.1.1-2+deb12u17.5.0-1
Show 15 moreShow less
7.5.0-27.5.0-37.6.0-17.6.0-27.6.1-17.6.1-27.7.0-17.7.0-27.7.0-37.7.1-17.7.2-17.7.2-27.7.3-17.7.3-27.7.3-3
 None known
varnish
Debian:13
 before 7.7.0-3+deb13u2, plus listed versions
7.7.0-37.7.0-3+deb13u1
7.7.0-3+deb13u2
varnish
Mageia:10
From an advisory covering 2 CVEs
 before 8.0.2-2.mga10
8.0.2-2.mga10
varnish
Mageia:9
From an advisory covering 2 CVEs
 before 7.7.3-1.1.mga9
7.7.3-1.1.mga9
varnish
openEuler:24.03-LTS-SP3
 before 7.4.3-5.oe2403sp3
7.4.3-5.oe2403sp3
varnish
openEuler:20.03-LTS-SP4
 before 7.4.3-5.oe2003sp4
7.4.3-5.oe2003sp4
varnish
openEuler:22.03-LTS-SP4
 before 7.4.3-5.oe2203sp4
7.4.3-5.oe2203sp4
varnish
openEuler:24.03-LTS-SP1
 before 7.4.3-5.oe2403sp1
7.4.3-5.oe2403sp1
varnish
openEuler:24.03-LTS-SP4
 before 7.4.3-5.oe2403sp4
7.4.3-5.oe2403sp4
varnish
Root:Debian:11
 before 6.5.1-1+deb11u5.aikido.3
6.5.1-1+deb11u5.aikido.36.5.1-1+deb11u5.root.io.26.5.1-1+deb11u5.aikido.4
Show 12 moreShow less
Affected packages
PackageAffectedFixed
rootio-varnish
Root:Debian:11
 before 6.5.1-1+deb11u5.aikido.3
6.5.1-1+deb11u5.aikido.36.5.1-1+deb11u5.root.io.26.5.1-1+deb11u5.aikido.4
varnish
Root:Debian:12
 before 7.1.1-2+deb12u1.root.io.7
7.1.1-2+deb12u1.root.io.77.1.1-2+deb12u1.aikido.8
rootio-varnish
Root:Debian:12
 before 7.1.1-2+deb12u1.root.io.7
7.1.1-2+deb12u1.root.io.77.1.1-2+deb12u1.aikido.8
varnish
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.0.4-1ubuntu13.0.4-1ubuntu23.0.5-1ubuntu23.0.5-23.0.5-2ubuntu0.1
 None known
varnish
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.0.3-14.1.0-14.1.0-24.1.1-14.1.1-1ubuntu0.24.1.1-1ubuntu0.2+esm1
 None known
varnish
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.0.0-7.15.2.1-15.2.1-1ubuntu0.15.2.1-1ubuntu0.1+esm1
 None known
varnish
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
6.1.1-16.2.1-26.2.1-2ubuntu0.1~esm16.2.1-2ubuntu0.1~esm26.2.1-2ubuntu0.16.2.1-2ubuntu0.26.2.1-2ubuntu0.2+esm1
 None known
varnish
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
6.5.2-16.6.1-16.6.1-1ubuntu0.26.6.1-1ubuntu0.2+esm1
 None known
varnish
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.1.1-1.1ubuntu1
 None known
varnish
Ubuntu:25.10
 All versions, plus listed versions
7.7.0-17.7.0-27.7.0-37.7.3-1
 None known
varnish
Ubuntu:26.10
 All versions, plus listed versions
7.7.3-1build1
 None known
varnish
Ubuntu:26.04:LTS
 All versions, plus listed versions
7.7.3-17.7.3-1build1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-34475 is a medium vulnerability (CVSS 5.4) in Varnish-software Varnish Cache, published March 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in varnish 7.7.0-3+deb13u2.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open