kritisch
CVE-2026-34475
Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (mittel).
Beschreibung
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | varnish | kein Fix angegeben |
| debian 12 | varnish | kein Fix angegeben |
| debian 13 | varnish | 7.7.0-3+deb13u2 |
| echo | varnish | 7.7.0-3+deb13u2 |
| rapidfort alma 10 | varnish, varnish-devel, varnish-docs und 1 weitere | kein Fix angegeben |
| rapidfort alma 9 | varnish-modules | kein Fix angegeben |
| rapidfort debian 12 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort debian 13 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort fedora 43 | collectd, collectd-amqp, collectd-amqp1 und 73 weitere | 5.12.0-57.fc43 und 3 weitere |
| rapidfort Oracle Linux 10 | varnish, varnish-devel, varnish-docs | kein Fix angegeben |
| rapidfort Red Hat 10 | varnish, varnish-devel, varnish-docs und 1 weitere | kein Fix angegeben |
| rapidfort Red Hat 9 | varnish-modules | kein Fix angegeben |
Alle 107 Einträge aus 17 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | varnish | kein Fix angegeben |
| debian 12 | varnish | kein Fix angegeben |
| debian 13 | varnish | 7.7.0-3+deb13u2 |
| echo | varnish | 7.7.0-3+deb13u2 |
| rapidfort alma 10 | varnish | kein Fix angegeben |
| rapidfort alma 10 | varnish-devel | kein Fix angegeben |
| rapidfort alma 10 | varnish-docs | kein Fix angegeben |
| rapidfort alma 10 | varnish-modules | kein Fix angegeben |
| rapidfort alma 9 | varnish-modules | kein Fix angegeben |
| rapidfort debian 12 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort debian 13 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort fedora 43 | collectd | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-amqp | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-amqp1 | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-apache | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ascent | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-bind | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ceph | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-chrony | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-curl | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-curl_json | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-curl_xml | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-dbi | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-disk | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-dns | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-drbd | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-email | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-generic-jmx | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-gps | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-hugepages | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-infiniband | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ipmi | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-iptables | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ipvs | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-java | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-log_logstash | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-lua | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mcelog | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mdevents | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-memcachec | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-modbus | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mqtt | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mysql | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-netlink | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-nginx | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-notify_desktop | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-notify_email | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-nut | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-onewire | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-openldap | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ovs_events | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ovs_stats | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-pinba | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ping | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-postgresql | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-python | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-redis | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-rrdcached | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-rrdtool | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-sensors | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-smart | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-snmp | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-snmp_agent | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-synproxy | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-utils | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-varnish | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-virt | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-web | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_http | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_kafka | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_mongodb | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_prometheus | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_redis | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_riemann | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_sensu | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_syslog | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_tsdb | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-xencpu | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-zookeeper | 5.12.0-57.fc43 |
| rapidfort fedora 43 | libcollectdclient | 5.12.0-57.fc43 |
| rapidfort fedora 43 | libcollectdclient-devel | 5.12.0-57.fc43 |
| rapidfort fedora 43 | perl-Collectd | 5.12.0-57.fc43 |
| rapidfort fedora 43 | varnish | 7.7.3-2.fc43 |
| rapidfort fedora 43 | varnish-devel | 7.7.3-2.fc43 |
| rapidfort fedora 43 | varnish-docs | 7.7.3-2.fc43 |
| rapidfort fedora 43 | varnish-modules | 0.26.0-4.fc43 |
| rapidfort fedora 43 | vmod-querystring | 2.0.3-11.fc43 |
| rapidfort Oracle Linux 10 | varnish | kein Fix angegeben |
| rapidfort Oracle Linux 10 | varnish-devel | kein Fix angegeben |
| rapidfort Oracle Linux 10 | varnish-docs | kein Fix angegeben |
| rapidfort Red Hat 10 | varnish | kein Fix angegeben |
| rapidfort Red Hat 10 | varnish-devel | kein Fix angegeben |
| rapidfort Red Hat 10 | varnish-docs | kein Fix angegeben |
| rapidfort Red Hat 10 | varnish-modules | kein Fix angegeben |
| rapidfort Red Hat 9 | varnish-modules | kein Fix angegeben |
| rapidfort rocky 10 | varnish | kein Fix angegeben |
| rapidfort rocky 10 | varnish-devel | kein Fix angegeben |
| rapidfort rocky 10 | varnish-docs | kein Fix angegeben |
| rapidfort rocky 10 | varnish-modules | kein Fix angegeben |
| rapidfort rocky 9 | varnish-modules | kein Fix angegeben |
| Red Hat | varnish-modules | kein Fix angegeben |
| Red Hat | varnish:6::varnish | kein Fix angegeben |
| Red Hat | varnish:6::varnish-devel | kein Fix angegeben |
| Red Hat | varnish:6::varnish-docs | kein Fix angegeben |
| Red Hat | varnish:6::varnish-modules | kein Fix angegeben |
| root.io debian 11 | rootio-varnish | kein Fix angegeben |
| root.io debian 12 | rootio-varnish | kein Fix angegeben |