Back Linuxsecurity

Debian varnish Fixes Cache Poisoning and Worker Crashes

Linuxsecurity •LinuxSecurity Advisories • October 25, 2026

Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Debian Varnish Cache Vulnerabilities Prompt Urgent Security Update Debian has released a security update addressing two vulnerabilities in Varnish Cache, identified as CVE-2026-34475 and CVE-2026-93894. CVE-2026-34475 involves a buffer overflow that could lead to denial of service, while CVE-2026-93894 allows for potential cache poisoning and authentication bypass through unchecked HTTP requests. These vulnerabilities affect the stable distribution of Debian, specifically version 7.7.0-3+deb13u2. Users are urged to upgrade their Varnish packages immediately to mitigate the risks. The vulnerabilities were publicly disclosed, with CVE-2026-34475 having a proof-of-concept released on April 30, 2026. The issues primarily impact systems using Varnish Cache in configurations that allow for the exploitation of these flaws. Current status indicates that patches are available and should be applied without delay. 3 sources 74

Extracted Entities

Debian varnish Fixes Cache Poisoning and Worker Crashes

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Platforms (1)