Critical severity · published Mar 27, 2026
CVE-2026-34475
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to…
9.8
CVSS
0.2%
EPSS
No
On KEV
Description
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
Varnish Cache · varnish-software
before 6.0.17 LTS; 7.0.0 before 8.0.1 · source: vendor
VE
Varnish Enterprise · Varnish-software
through 6.0.15; 6.0.16; 6.0.16; 6.0.16; 6.0.16; 6.0.16; +6 more · source: NVD
VC
Vinyl Cache · Vinyl-cache
before 8.0.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34475
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34475
Mitigation
https://vinyl-cache.org/security/VSV00018.html
More from Varnish Cache
9.1
CVE-2022-23959
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4,…
7.5
CVE-2026-40396
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger
7.5
CVE-2026-40394
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data
7.5
CVE-2025-8671
No description published yet
7.5
CVE-2022-45060
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1