Varnish Enterprise CVE-2026-34475

The CVSS 5.4 score (AV:N/AC:H/PR:N/UI:N/S:C) reflects network-reachable, unauthenticated attack surface with high complexity and partial impact (confidentiality and integrity, no availability loss). SSVC assessment categorizes this as low-urgency: exploitation status is 'none' (no confirmed active use), automatable status is 'no' (requiring manual crafting of specific URL patterns), and technical impact is 'partial' (not total system compromise). The CVSS AC:H (high complexity) qualifier significantly reduces real-world risk compared to simpler attack vectors. This is a genuine but limited-risk issue: cache poisoning and authentication bypass are serious in principle, but the high attack complexity and lack of automation or active exploitation suggest this is a lower-priority vulnerability relative to common Web application flaws. Organizations with strict cache integrity requirements or public-facing authentication systems proxied through Varnish should prioritize patching; others may defer based on patch availability and operational impact.

An attacker sends an HTTP/1.1 request to a Varnish-proxied website with a crafted root-path URL (/) that is mishandled by the cache. Due to the unchecked req.url, Varnish caches the response with incorrect metadata or bypasses authentication checks. Subsequent requests from legitimate users receive the poisoned cached response, potentially exposing sensitive data or allowing attackers to inject malicious content. The attack requires moderate knowledge of the target application and Varnish configuration to succeed, explaining the high attack complexity rating. No public exploit code or active exploitation in the wild has been identified at the time of this analysis.