PT-2026-28633 · Varnish · Varnish Enterprise+1

Published 2026-03-27 · Updated 2026-03-28 · CVE-2026-34475

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 8.0.1 Varnish Enterprise versions prior to 6.0.16r12

Description The software may improperly handle URLs with a path of '/' for HTTP/1.1 in certain unchecked request URL scenarios. This could potentially lead to cache poisoning or authentication bypass.

Recommendations Update Varnish Cache to version 8.0.1 or later. Update Varnish Enterprise to version 6.0.16r12 or later.

Fix

Weakness Enumeration

CWE-180

Related Identifiers

CVE-2026-34475

Affected Products

Varnish Cache

Varnish Enterprise

References · 8

• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34475 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34475 · Security Note
• https://ubuntu.com/security/CVE-2026-34475 · Vendor Advisory
• https://vinyl-cache.org/security/VSV00018.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34475 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34475 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-34475 · Vendor Advisory
• https://twitter.com/CVEnew/status/2037719415970824387 · Twitter Post