External risk intelligence

Varnish Cache and Enterprise URL Handling Flaw Allows Cache Poisoning Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-34475

Varnish Cache is an HTTP accelerator and reverse proxy designed specifically to sit at the network edge, handling incoming web traffic. Because it is public-facing by design in normal deployment as a web/API gateway, this vulnerability in how it handles HTTP request URLs is directly exposed to the internet.

Authentication Bypass

Varnish Software Varnish Enterprise

6.0.15 and earlier6.0.16before 8.0.1

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Varnish Cache and Varnish Enterprise, which are used for web traffic acceleration and caching. The issue could allow unauthorized parties to poison the cache or bypass authentication mechanisms by exploiting how certain URLs are processed. The main concern is confirming relevance and exposure for these systems.

Systems could be tricked into showing wrong content.
Affects public-facing web traffic acceleration.
Understand exposure; confirm relevance for Varnish.

Attack Path

How an attacker could exploit the issue

An attacker can reach a vulnerable Varnish Cache or Varnish Enterprise instance over the network and send it specially crafted HTTP requests. These requests, by exploiting how the software handles URLs with a root path, can lead to the server misinterpreting requests or responses. This could result in sensitive information being exposed or unauthorized access to resources.

No special access needed.
Malformed HTTP request.
Cache poisoning or auth bypass.

Live Threat

Current exploitation, exposure, and threat context

When Varnish Cache or Varnish Enterprise encounters specific unchecked HTTP/1.1 requests with a path of `/`, it may mishandle the URL. This could lead to the cache storing incorrect content or allowing unauthorized access to resources.

Cache poisoning or unauthorized access.
Mishandled root URLs in HTTP/1.1 requests.
Compromised service integrity and access.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Varnish Cache and Varnish Enterprise impacts teams managing web traffic and application delivery. Infrastructure, platform, and security teams should collaborate to identify where these products are deployed. The immediate first step is to locate all instances, assess their exposure and criticality, and then assign ownership for remediation planning.

Infrastructure or Platform teams own the issue.
Verify Varnish instance exposure and criticality.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Varnish Cache and how is it used?

Varnish Cache and Varnish Enterprise are specialized software tools acting as HTTP accelerators and reverse proxies. By sitting at the front of a web server stack, they handle incoming internet traffic to cache content and speed up website delivery. Because they manage incoming requests, they are essential for performance and reliability in high-traffic web environments.

What is the vulnerability behind CVE-2026-34475?

This vulnerability is classified as CWE-180, which involves the improper handling of special elements in a path. In this specific case, the software fails to correctly process certain HTTP/1.1 request URLs that contain a root path. This logic error allows an attacker to manipulate how the cache interprets or stores data, potentially leading to unauthorized access or the corruption of cached content.

How does an attacker trigger this URL handling flaw?

An attacker triggers the flaw by sending a specially crafted HTTP/1.1 request targeting the root path of the application. The vulnerability specifically relates to how the system performs unchecked URL processing for these requests. If the request does not involve these specific malformed root path structures, it does not trigger the underlying logic error.

Why is this CVE considered relevant for my infrastructure?

According to Halo Surface Signal, this vulnerability is highly relevant because Varnish Cache is designed to be public-facing by nature. Since it typically functions at the network edge as a gateway for all incoming traffic, any instance exposed to the internet is directly reachable by an attacker. Systems handling web or API traffic are at the greatest risk.

What steps should I take if I run Varnish Cache?

Start by identifying all deployed instances of Varnish Cache or Varnish Enterprise within your environment. Once you have a complete inventory, prioritize these assets based on their exposure to external traffic and their criticality to your services. Coordinate with your infrastructure and platform teams to plan for necessary software updates and ensure the vulnerability is addressed.

References

vinyl-cache.org/security/VSV00018.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.