CVE-2026-34475
Varnish-Software Varnish Enterprise ≤ 6.0.15
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2026-34475 is a medium-severity Incorrect Behavior Order: Validate Before Canonicalize (CWE-180) vulnerability in Varnish-Software Varnish Enterprise. Its CVSS base score is 5.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-34475 is a vulnerability in Varnish Cache before version 8.0.1 and Varnish Enterprise before 6.0.16r12. In certain unchecked req.url scenarios, the software mishandles URLs with a path of / for HTTP/1.1 requests, potentially leading to cache poisoning or authentication bypass. The issue is classified under CWE-180 and carries a CVSS v3.1 base score of 5.4 (AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N), indicating medium severity with network accessibility, high attack complexity, no privileges or user interaction required, and a changed scope affecting low confidentiality and integrity.
Remote, unauthenticated attackers can exploit this vulnerability over the network by crafting specific HTTP/1.1 requests that trigger the mishandling of root-path URLs. Exploitation requires sophisticated manipulation due to the high attack complexity but could enable cache poisoning, where malicious responses are stored and served to subsequent users, or authentication bypass, allowing unauthorized access to backend resources without valid credentials.
Mitigation involves upgrading to Varnish Cache 8.0.1 or later and Varnish Enterprise 6.0.16r12 or later. Further details on patches and workarounds are provided in the vendor advisory at https://vinyl-cache.org/security/VSV00018.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16801
Vulnerability Data
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.8V1.1.1V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
SA-11 requires developer testing and evaluation that can discover validation-order defects after they have been coded.
SI-10 requires validity checks on inputs; when implemented with canonicalization preceding validation it structurally prevents the exact ordering flaw.
SA-8 mandates security engineering principles that include correct canonicalization-before-validation ordering for input handling.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct validation order after canonicalization to prevent bypasses.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect validation-order defects before deployment.
Secure SDLC mandates input validation and canonicalization order, directly addressing CWE-180.
Application security requirements include proper input handling to prevent validation-before-canonicalization flaws.
Secure architecture principles reduce the likelihood of ordering errors in input processing.
Secure coding standards explicitly require canonicalize-then-validate to eliminate CWE-180.