Updated varnish packages fix security vulnerabilities
Publication date: 01 Sep 2026Modification date: 01 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-34475 , CVE-2026-50052
Description
The updated packages fix security vulnerabilities:
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in
certain unchecked req.url scenarios, mishandle URLs with a path of / for
HTTP/1.1, potentially leading to cache poisoning or authentication
bypass. (CVE-2026-34475)
In Vinyl Cache before 9.0.1 and Varnish Cache before 9.0.3, a deficiency
in HTTP/2 request parsing can be exploited to launch a backend request
desync attack (request smuggling), which in turn can be used for cache
poisoning, authentication bypass, or possibly even information
disclosure and manipulation. The attack vector only exists if HTTP/2
support is enabled by setting the feature parameter to contain +http2.
HTTP/2 support is disabled by default. (CVE-2026-50052)
References
- https://bugs.mageia.org/show_bug.cgi?id=35703
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QTQ3IFV7A766BA4ZMWNVCZOAN3FGCW2J/
- https://vinyl-cache.org/security/VSV00018.html
- https://vinyl-cache.org/security/VSV00019.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W24WNWHXMWTWVX7NH65HHLBVOBMB3QGQ/
- https://www.cve.org/CVERecord?id=CVE-2026-34475
- https://www.cve.org/CVERecord?id=CVE-2026-50052
SRPMS
10/core
- varnish-8.0.2-2.mga10
9/core
- varnish-7.7.3-1.1.mga9