CVE-2026-34475: 
collectd vulnerability analysis and mitigation

CVE-2026-34475 is a URL handling vulnerability in Varnish Cache and Varnish Enterprise that can lead to cache poisoning or authentication bypass. In certain unchecked req.url scenarios, the software mishandles HTTP/1.1 requests with a URL path of /, failing to validate before canonicalization. Affected versions include Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12. The vulnerability was published on March 27, 2026, with a patch available as of April 22, 2026. CVSS v3.1 scores vary by source: NVD assigns 9.8 (Critical), while ENISA rates it 5.4 (Medium) with a changed scope vector (Red Hat Advisory, Varnish Security Advisory).

The root cause is classified as CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize), meaning Varnish processes and validates the URL before normalizing it, allowing crafted inputs to slip through validation checks. Specifically, HTTP/1.1 requests with a path of / in unchecked req.url scenarios are mishandled, enabling an attacker to supply malformed or alternate-encoded URLs that bypass VCL (Varnish Configuration Language) access controls or cache key logic. Related attack patterns include leveraging alternate encodings (CAPEC-267, CAPEC-71, CAPEC-78, CAPEC-79, CAPEC-80) and ghost character sequences (CAPEC-3) to evade input filters. No public proof-of-concept code has been confirmed at this time (Red Hat Advisory, Varnish Security Advisory).

Successful exploitation can result in cache poisoning — causing downstream users to receive malicious or incorrect cached responses — or authentication bypass, granting unauthorized access to protected resources. Because Varnish Cache typically sits in front of web applications serving large user populations, a poisoned cache entry can affect many users simultaneously without requiring individual targeting. Confidentiality and integrity of cached content are both at risk, though availability impact is limited. The changed-scope nature of the ENISA vector indicates potential for cross-user impact beyond the direct attacker session (Red Hat Advisory, Varnish Security Advisory).

No public proof-of-concept exploit has been confirmed, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Sploitus entry referencing an exploit ID was observed in late April 2026, but no verified weaponized exploit has been confirmed (Varnish Security Advisory, Tenable Nessus).

1. Reconnaissance: Identify internet-facing Varnish Cache or Varnish Enterprise instances using tools like Shodan or Censys, targeting versions before 8.0.1 (Cache) or 6.0.16r12 (Enterprise).
2. Craft malicious HTTP/1.1 request: Construct an HTTP/1.1 request with a specially formed URL path (e.g., using alternate encodings, double slashes, or Unicode representations of /) that passes Varnish's pre-canonicalization validation but is interpreted differently after normalization.
3. Target unchecked req.url scenario: Send the crafted request to an endpoint where VCL does not explicitly sanitize or check req.url before making cache or access control decisions, exploiting the validate-before-canonicalize flaw.
4. Achieve cache poisoning or auth bypass: If targeting cache poisoning, manipulate the cache key so that the malicious response is stored and served to legitimate users. If targeting authentication bypass, craft the URL so that access control checks in VCL are circumvented, granting access to restricted backend resources (Varnish Security Advisory, Red Hat Advisory).

• Network: Unusual HTTP/1.1 requests to Varnish with URL paths containing encoded or alternate representations of / (e.g., %2F, //, %252F, Unicode variants); unexpected cache HIT responses for requests that should be cache MISSes or access-denied.
• Logs: Varnish access logs (varnishlog) showing requests with malformed or double-encoded path components resulting in unexpected backend responses or cache hits on protected resources; repeated requests from a single IP with varying URL encodings for the same path.
• Cache Behavior: Anomalous cache hit/miss ratios; cached responses for URLs that should not be cacheable (e.g., authenticated or POST endpoints); users reporting receiving content intended for other users.
• Process/Config: VCL configurations where req.url is used in access control or cache key logic without prior sanitization or normalization (Varnish Security Advisory).

Varnish Cache users should upgrade to version 8.0.1 or later; Varnish Enterprise users should upgrade to version 6.0.16r12 or later. As a configuration-based workaround, administrators should audit all VCL code to ensure req.url is explicitly sanitized or normalized before being used in access control decisions or cache key logic. Implementing WAF rules to detect and block HTTP/1.1 requests with malformed or alternate-encoded path components can provide additional defense-in-depth. Monitoring cache hit/miss patterns for anomalies is recommended until patching is complete (Varnish Security Advisory, Red Hat Advisory).

A security blogger noted CVE-2026-34475 in a weekly "interesting CVEs" roundup for the week of March 31, 2026, highlighting its cache poisoning and authentication bypass potential (Jon W. Weblog). Red Hat has tracked the vulnerability in its security advisory database. No major vendor statements beyond the patch advisory or significant social media campaigns have been identified at this time.