critical
CVE-2026-34475
Varnish Cache: Varnish Cache and Varnish Enterprise: Cache poisoning and authentication bypass via unchecked URL handling
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat5.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (medium).
Description
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | varnish | no fix listed |
| debian 12 | varnish | no fix listed |
| debian 13 | varnish | 7.7.0-3+deb13u2 |
| echo | varnish | 7.7.0-3+deb13u2 |
| rapidfort alma 10 | varnish, varnish-devel, varnish-docs and 1 more | no fix listed |
| rapidfort alma 9 | varnish-modules | no fix listed |
| rapidfort debian 12 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort debian 13 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort fedora 43 | collectd, collectd-amqp, collectd-amqp1 and 73 more | 5.12.0-57.fc43 and 3 more |
| rapidfort Oracle Linux 10 | varnish, varnish-devel, varnish-docs | no fix listed |
| rapidfort Red Hat 10 | varnish, varnish-devel, varnish-docs and 1 more | no fix listed |
| rapidfort Red Hat 9 | varnish-modules | no fix listed |
Show all 107 entries from 17 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | varnish | no fix listed |
| debian 12 | varnish | no fix listed |
| debian 13 | varnish | 7.7.0-3+deb13u2 |
| echo | varnish | 7.7.0-3+deb13u2 |
| rapidfort alma 10 | varnish | no fix listed |
| rapidfort alma 10 | varnish-devel | no fix listed |
| rapidfort alma 10 | varnish-docs | no fix listed |
| rapidfort alma 10 | varnish-modules | no fix listed |
| rapidfort alma 9 | varnish-modules | no fix listed |
| rapidfort debian 12 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort debian 13 | varnish | 0:7.7.0-3+deb13u2 |
| rapidfort fedora 43 | collectd | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-amqp | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-amqp1 | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-apache | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ascent | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-bind | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ceph | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-chrony | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-curl | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-curl_json | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-curl_xml | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-dbi | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-disk | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-dns | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-drbd | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-email | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-generic-jmx | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-gps | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-hugepages | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-infiniband | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ipmi | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-iptables | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ipvs | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-java | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-log_logstash | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-lua | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mcelog | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mdevents | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-memcachec | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-modbus | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mqtt | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-mysql | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-netlink | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-nginx | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-notify_desktop | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-notify_email | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-nut | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-onewire | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-openldap | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ovs_events | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ovs_stats | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-pinba | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-ping | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-postgresql | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-python | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-redis | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-rrdcached | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-rrdtool | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-sensors | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-smart | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-snmp | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-snmp_agent | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-synproxy | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-utils | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-varnish | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-virt | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-web | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_http | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_kafka | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_mongodb | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_prometheus | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_redis | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_riemann | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_sensu | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_syslog | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-write_tsdb | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-xencpu | 5.12.0-57.fc43 |
| rapidfort fedora 43 | collectd-zookeeper | 5.12.0-57.fc43 |
| rapidfort fedora 43 | libcollectdclient | 5.12.0-57.fc43 |
| rapidfort fedora 43 | libcollectdclient-devel | 5.12.0-57.fc43 |
| rapidfort fedora 43 | perl-Collectd | 5.12.0-57.fc43 |
| rapidfort fedora 43 | varnish | 7.7.3-2.fc43 |
| rapidfort fedora 43 | varnish-devel | 7.7.3-2.fc43 |
| rapidfort fedora 43 | varnish-docs | 7.7.3-2.fc43 |
| rapidfort fedora 43 | varnish-modules | 0.26.0-4.fc43 |
| rapidfort fedora 43 | vmod-querystring | 2.0.3-11.fc43 |
| rapidfort Oracle Linux 10 | varnish | no fix listed |
| rapidfort Oracle Linux 10 | varnish-devel | no fix listed |
| rapidfort Oracle Linux 10 | varnish-docs | no fix listed |
| rapidfort Red Hat 10 | varnish | no fix listed |
| rapidfort Red Hat 10 | varnish-devel | no fix listed |
| rapidfort Red Hat 10 | varnish-docs | no fix listed |
| rapidfort Red Hat 10 | varnish-modules | no fix listed |
| rapidfort Red Hat 9 | varnish-modules | no fix listed |
| rapidfort rocky 10 | varnish | no fix listed |
| rapidfort rocky 10 | varnish-devel | no fix listed |
| rapidfort rocky 10 | varnish-docs | no fix listed |
| rapidfort rocky 10 | varnish-modules | no fix listed |
| rapidfort rocky 9 | varnish-modules | no fix listed |
| Red Hat | varnish-modules | no fix listed |
| Red Hat | varnish:6::varnish | no fix listed |
| Red Hat | varnish:6::varnish-devel | no fix listed |
| Red Hat | varnish:6::varnish-docs | no fix listed |
| Red Hat | varnish:6::varnish-modules | no fix listed |
| root.io debian 11 | rootio-varnish | no fix listed |
| root.io debian 12 | rootio-varnish | no fix listed |