by Kastro
Paper/Archive/CVE-2026-34475

CVE-2026-34475

varnish-software Varnish Cache — Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of…

EPSS 0.2%CVSS 9.8
critical.is priorityof 100
32
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 11.2.112 × 202.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Affected

ProductAffectedFixed inSource
Varnish Cache< 6.0.17 LTS6.0.17 LTSCNA
Varnish Cache7.0.0 – < 8.0.18.0.1CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
mitre (CNA)5.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refvinyl-cache.org/security/VSV00018.html