CVE-2026-34475: Varnish-Software Varnish Enterprise

Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days.

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Affected products

• Varnish-Software Varnish Enterprise: up to and including 6.0.15; version 6.0.16 only
• Vinyl-Cache Vinyl Cache: before 8.0.1 (fixed in 8.0.1)

Published 2026-03-27. Last modified 2026-06-17.