CVE-2026-34475

CVSS Score & Metrics

Base Score

5.4 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N                                    

Vulnerability Description

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Vulnerability Details

Published Date

March 27, 2026

Last Modified

March 30, 2026

CWE ID

CWE-180

Source

NVD

Vendor

varnish-software

Product

Varnish Cache

External References

https://vinyl-cache.org/security/VSV00018.html

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment