Kritik CVSS 9.8
CVE-2026-34475: Varnish Enterprise: güvenlik açığı
Açıklama (NVD)
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.
Özet bilgiler
- Ürün
- Varnish-software Varnish Enterprise
- CVSS v3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- %0,21 (yüzdelik 11)
- CWE
- CWE-180
- Yama
- Geçici çözüm
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| varnish-software-varnish-enterprise | — | 6.0.15 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| varnish-software-varnish-enterprise | 6.0.16 | 6.0.16 | — |
| vinyl-cache-vinyl-cache | — | — | 8.0.1 |