{"attribution":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","cve":{"id":"CVE-2026-34475","sourceIdentifier":"cve@mitre.org","published":"2026-03-27T20:16:36.390","lastModified":"2026-10-26T22:10:00.163","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass."},{"lang":"es","value":"Varnish Cache anterior a la versión 8.0.1 y Varnish Enterprise anterior a la versión 6.0.16r12, en ciertos escenarios de req.url no verificados, manejan incorrectamente las URL con una ruta de / para HTTP/1.1, lo que podría llevar a envenenamiento de caché u omisión de autenticación."}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"varnish-software","product":"Varnish Cache","defaultStatus":"unaffected","versions":[{"version":"0","lessThan":"6.0.17 LTS","versionType":"custom","status":"affected"},{"version":"7.0.0","lessThan":"8.0.1","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"cve@mitre.org","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.2,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-03-27T20:00:56.066373Z","id":"CVE-2026-34475","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"cve@mitre.org","type":"Secondary","description":[{"lang":"en","value":"CWE-180"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*","versionEndIncluding":"6.0.15","matchCriteriaId":"E53A64C0-FC22-40B5-8C3B-6288B44AC3FC"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*","matchCriteriaId":"F24D68B5-362E-4797-B6DE-C19A2893186C"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*","matchCriteriaId":"910BAD01-26E5-4D12-AA23-0BD2D48F229C"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r11:*:*:*:*:*:*","matchCriteriaId":"BCF39307-6F25-4D97-8901-EE1A80A66AD9"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*","matchCriteriaId":"05E529DF-DEE1-4A62-998B-CA312DF888FD"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*","matchCriteriaId":"8AB27B34-2951-4755-851C-7C942DAFB6C7"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*","matchCriteriaId":"18A22D42-B038-4E09-92DD-8AFD2F51A340"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*","matchCriteriaId":"FE76D616-3AA8-4D9A-9D41-9AE35FE20DBC"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*","matchCriteriaId":"9C5610CF-1FE4-4DF8-8D49-7C0CCF0359E4"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*","matchCriteriaId":"27B776B2-9C38-45BE-89E4-ECDEEAE538A9"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*","matchCriteriaId":"ED3CA600-C88D-4825-8C36-E052822AF59F"},{"vulnerable":true,"criteria":"cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*","matchCriteriaId":"6B1D57B1-9771-4195-9EE3-B26EA776FB6B"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vinyl-cache:vinyl_cache:*:*:*:*:*:*:*:*","versionEndExcluding":"8.0.1","matchCriteriaId":"3C1ED7AA-6E2F-4C75-82D3-D7C2CB125C48"}]}]}],"references":[{"url":"https://vinyl-cache.org/security/VSV00018.html","source":"cve@mitre.org","tags":["Mitigation","Vendor Advisory"]}]}}