← Vulnerability feed

Vulnerability record · CVE-2026-34475 · published 27 March 2026

CVE-2026-34475: Varnish-software varnish enterprise vulnerability

Varnish Software · Varnish Enterprise

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

9.8 CVSS 3.1 Critical EPSS 0.37% · top 71.9% CWE-180 · CWE-180
9.8CVSS 3.1 base score
0.37%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
1References
17 Jun 2026Last modified by NVD

Description

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://vinyl-cache.org/security/VSV00018.html MitigationVendor Advisory

Track CVE-2026-34475 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-40396Vinyl-cache vinyl cache vulnerabilityVarnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HT…EPSS 0.45%7.5CVE-2026-40395Varnish-software varnish enterprise allocation without limits vulnerabilityVarnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() functi…EPSS 0.40%7.5CVE-2026-40394Varnish-software varnish enterprise vulnerabilityVarnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amoun…EPSS 0.40%7.5CVE-2025-30347Varnish-software varnish enterprise out-of-bounds read vulnerabilityVarnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-bounds read for range requests on ephemeral…EPSS 0.35%6.5CVE-2023-41104Varnish-software varnish enterprise memory buffer overflow vulnerabilitylibvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, leading …EPSS 0.60%4.8CVE-2025-30346Varnish-software varnish enterprise http request smuggling vulnerabilityVarnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.EPSS 0.31%

Source: NIST National Vulnerability Database (record CVE-2026-34475), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.