MEDIUM🇬🇧 English

CVE-2026-34475

CVSS 5.4v3.1pub. 2026-03-27upd. 2026-04-22

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

  • Varnish Software Varnish Enterprise

    APP
    Varnish-Software
    6.0.16≤ 6.0.15

  • Vinyl Cache

    APP
    Vinyl-Cache
    < 8.0.1
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
Auth Bypass
CWE
Referencje

Powiązane podatności

CVE-2026-40394MEDIUM4.0ten sam produkt

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of s...

CVE-2026-40395MEDIUM4.0ten sam produkt

Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared ...

CVE-2026-40396MEDIUM4.0ten sam produkt

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_ling...

CVE-2025-30346MEDIUM5.4ten sam produkt

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 request...

CVE-2025-30347MEDIUM4.0ten sam produkt

Varnish Enterprise before 6.0.13r13 allows remote attackers to obtain sensitive information via an out-of-boun...