{"id":"CVE-2026-34475","aliases":["DEBIAN-CVE-2026-34475","EUVD-2026-16801","GHSA-m9gq-cmcj-p62x","MGASA-2026-0357","OESA-2026-2677","OESA-2026-3045","ROOT-OS-DEBIAN-11-CVE-2026-34475","ROOT-OS-DEBIAN-12-CVE-2026-34475","UBUNTU-CVE-2026-34475"],"status":"published","title":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url...","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0021,"percentile":0.11269,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-180"],"published":"2026-03-27T19:40:28Z","modified":"2026-10-27T09:47:31Z","fixes":[{"ecosystem":"Debian:13","package":"varnish","fixed_in":["7.7.0-3+deb13u2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"varnish","fixed_in":["7.4.3-5.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-5.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","fixed_in":["7.4.3-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-5.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"varnish","fixed_in":["6.5.1-1+deb11u5.aikido.3","6.5.1-1+deb11u5.root.io.2","6.5.1-1+deb11u5.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-varnish","fixed_in":["6.5.1-1+deb11u5.aikido.3","6.5.1-1+deb11u5.root.io.2","6.5.1-1+deb11u5.aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"varnish","fixed_in":["7.1.1-2+deb12u1.root.io.7","7.1.1-2+deb12u1.aikido.8"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-varnish","fixed_in":["7.1.1-2+deb12u1.root.io.7","7.1.1-2+deb12u1.aikido.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2","7.1.1-2+deb12u1","7.5.0-1","7.5.0-2","7.5.0-3","7.6.0-1","7.6.0-2","7.6.1-1","7.6.1-2","7.7.0-1","7.7.0-2","7.7.0-3","7.7.1-1","7.7.2-1","7.7.2-2","7.7.3-1","7.7.3-2","7.7.3-3"]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-3+deb13u2"}]}],"versions":["7.7.0-3","7.7.0-3+deb13u1"]},{"source":"osv","ecosystem":"Mageia:10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.0.2-2.mga10"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:9","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.3-1.1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-5.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-5.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-5.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1+deb11u5.aikido.3"},{"fixed":"6.5.1-1+deb11u5.root.io.2"},{"fixed":"6.5.1-1+deb11u5.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1+deb11u5.aikido.3"},{"fixed":"6.5.1-1+deb11u5.root.io.2"},{"fixed":"6.5.1-1+deb11u5.aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1.root.io.7"},{"fixed":"7.1.1-2+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1.root.io.7"},{"fixed":"7.1.1-2+deb12u1.aikido.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-1ubuntu1","3.0.4-1ubuntu2","3.0.5-1ubuntu2","3.0.5-2","3.0.5-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-1","4.1.0-1","4.1.0-2","4.1.1-1","4.1.1-1ubuntu0.2","4.1.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-7.1","5.2.1-1","5.2.1-1ubuntu0.1","5.2.1-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1-1","6.2.1-2","6.2.1-2ubuntu0.1~esm1","6.2.1-2ubuntu0.1~esm2","6.2.1-2ubuntu0.1","6.2.1-2ubuntu0.2","6.2.1-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.6.1-1","6.6.1-1ubuntu0.2","6.6.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7.0-1","7.7.0-2","7.7.0-3","7.7.3-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.7.3-1","7.7.3-1build1"]}],"products":[{"vendor":"varnish-software","product":"varnish cache"},{"vendor":"varnish-software","product":"varnish_enterprise"},{"vendor":"vinyl-cache","product":"vinyl_cache"}],"references":[{"url":"https://vinyl-cache.org/security/VSV00018.html","tags":["Mitigation","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34475","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-m9gq-cmcj-p62x"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-34475","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0357.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35703","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTQ3IFV7A766BA4ZMWNVCZOAN3FGCW2J/","tags":["web"]},{"url":"https://vinyl-cache.org/security/VSV00019.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W24WNWHXMWTWVX7NH65HHLBVOBMB3QGQ/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2677","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3045","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-34475","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-34475","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-34475","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","status":"published","published":"2026-03-27T19:40:28.397Z","modified":"2026-03-27T20:01:11.327Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-180"],"updated_at":"2026-11-02T14:20:14.302133Z"}],"euvd":[{"id":"EUVD-2026-16801","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","status":"published","published":"2026-03-27T19:40:28Z","modified":"2026-03-27T20:01:11Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:25:26.783049Z"}],"ghsa":[{"id":"GHSA-m9gq-cmcj-p62x","title":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url...","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","status":"published","published":"2026-03-27T21:31:37Z","modified":"2026-03-27T21:31:44Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-180"],"updated_at":"2026-11-02T15:06:54.610516Z"}],"nvd":[{"id":"CVE-2026-34475","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","status":"published","published":"2026-03-27T20:16:36.39Z","modified":"2026-10-26T22:10:00.163Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-180"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"DEBIAN-CVE-2026-34475","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","status":"published","published":"2026-03-27T20:16:36.39Z","modified":"2026-10-27T09:47:31.517054084Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:54.587575Z"},{"id":"OESA-2026-2677","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nVarnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.(CVE-2026-34475)","status":"published","published":"2026-06-12T11:11:36Z","modified":"2026-08-18T01:20:05.661588865Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-3045","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nVarnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.(CVE-2026-34475)","status":"published","published":"2026-07-19T11:11:56Z","modified":"2026-08-18T01:21:19.972579117Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-34475","title":"CVE-2026-34475 in varnish - Patched by Root","description":"Root has patched CVE-2026-34475 in the varnish package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-09-10T10:15:45Z","modified":"2026-09-10T11:15:06.421998107Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-34475","title":"CVE-2026-34475 in varnish - Patched by Root","description":"Root has patched CVE-2026-34475 in the varnish package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-26T07:38:20Z","modified":"2026-08-26T09:00:13.454458116Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"UBUNTU-CVE-2026-34475","description":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.","status":"published","published":"2026-03-27T20:16:00Z","modified":"2026-10-17T13:00:01.44535816Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:56:16.036833Z"},{"id":"MGASA-2026-0357","title":"Updated varnish packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\nVarnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in\ncertain unchecked req.url scenarios, mishandle URLs with a path of / for\nHTTP/1.1, potentially leading to cache poisoning or authentication\nbypass. (CVE-2026-34475)\nIn Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency\nin HTTP/2 request parsing can be exploited to launch a backend request\ndesync attack (request smuggling), which in turn can be used for cache\npoisoning, authentication bypass, or possibly even information\ndisclosure and manipulation. The attack vector only exists if HTTP/2\nsupport is enabled by setting the feature parameter to contain +http2.\nHTTP/2 support is disabled by default. (CVE-2026-50052)\n","status":"published","published":"2026-09-01T03:06:53Z","modified":"2026-09-01T03:15:03.591065034Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}