VYPR
Get started
← All advisories
Medium severity5.4NVD Advisory· Published Mar 27, 2026· Updated Apr 22, 2026

CVE-2026-34475

CVE-2026-34475

Description

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Affected products

13
  • Varnish Software/Varnish Enterprise12 versions
    cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*+ 11 more
    • cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*range: <=6.0.15
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r11:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*
    • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*
  • Vinyl Cache/Vinyl Cache
    cpe:2.3:a:vinyl-cache:vinyl_cache:*:*:*:*:*:*:*:*
    Range: <8.0.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.