Read the docs
TI-2026-26733 Aliases CVE-2026-34475GHSA-m9gq-cmcj-p62x

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked…

Priority MEDIUM 41CWE-180Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0021 11th percentileScored 2026-11-07
Fix Partial Varnish Cache (varnish-software): 6.0.17 LTS, 8.0.1Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
varnish-softwareVarnish Cachebefore 6.0.17 LTS; 7.0.0 to before 8.0.16.0.17 LTS, 8.0.1Patch availableCNA
  • Varnish Cache Vendorvarnish-software Affected before 6.0.17 LTS; 7.0.0 to before 8.0.1 Fixed in 6.0.17 LTS, 8.0.1 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*up to 6.0.15Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*6.0.16 r1Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*6.0.16 r10Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r11:*:*:*:*:*:*6.0.16 r11Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*6.0.16 r2Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*6.0.16 r3Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*6.0.16 r4Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*6.0.16 r5Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*6.0.16 r6Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*6.0.16 r7Vulnerablevarnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:* Versions up to 6.0.15 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:* Versions 6.0.16 r1 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:* Versions 6.0.16 r10 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r11:*:*:*:*:*:* Versions 6.0.16 r11 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:* Versions 6.0.16 r2 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:* Versions 6.0.16 r3 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:* Versions 6.0.16 r4 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:* Versions 6.0.16 r5 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:* Versions 6.0.16 r6 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:* Versions 6.0.16 r7 Vulnerable ·varnish-software
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*6.0.16 r8Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*6.0.16 r9Vulnerablevarnish-software
cpe:2.3:a:vinyl-cache:vinyl_cache:*:*:*:*:*:*:*:*before 8.0.1VulnerableVinyl-Cache
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:* Versions 6.0.16 r8 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:* Versions 6.0.16 r9 Vulnerable ·varnish-software
  • cpe:2.3:a:vinyl-cache:vinyl_cache:*:*:*:*:*:*:*:* Versions before 8.0.1 Vulnerable ·Vinyl-Cache

Remediation

  • Fix · CNA Varnish Cache (varnish-software) Fixed in 6.0.17 LTS, 8.0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34475
  2. 2026-10-03 Alias added: GHSA-m9gq-cmcj-p62x

References

Advisory 1

  • TI-2023-21726 libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an… CVSS 3.1MEDIUM 6.5
  • TI-2025-21653 Out-of-bounds read in varnish-software Varnish Enterprise CVSS 3.1HIGH 7.5
  • TI-2026-29163 Resource allocation without limits in varnish-software Varnish Enterprise CVSS 3.1HIGH 7.5
  • TI-2026-29162 Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace… CVSS 3.1HIGH 7.5
  • TI-2025-21652 Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences