PT-2026-28633 · Varnish · Varnish Enterprise+1

CVE-2026-34475 · Publicado 2026-03-27 · Atualizado 2026-07-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 8.0.1 Varnish Enterprise versions prior to 6.0.16r12

Description The software may improperly handle URLs with a path of '/' for HTTP/1.1 in certain unchecked request URL scenarios. This could potentially lead to cache poisoning or authentication bypass.

Recommendations Update Varnish Cache to version 8.0.1 or later. Update Varnish Enterprise to version 6.0.16r12 or later.

Correção

Enumeração de Fraquezas

CWE-180

Identificadores relacionados

CVE-2026-34475

OESA-2026-2677

Produtos afetados

Varnish Cache

Varnish Enterprise

Referências · 13

• https://security-tracker.debian.org/tracker/CVE-2026-34475 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-34475 · Aviso do Fabricante
• https://twitter.com/threatcluster/status/2065630382590984337 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-34475 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-34475 · Nota de Segurança
• https://vinyl-cache.org/security/VSV00018.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2026-34475 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2026-2677 · Aviso do Fabricante
• https://openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2677 · Nota
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-34475 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037719415970824387 · Publicação no Twitter
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34475 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34475 · Aviso do Fabricante