DSA-6584-1 release notes and known issues

Summary

Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1 absolute-form request targets. If the request URL is passed unchecked to a backend which accepts absolute-form URIs, a remote attacker could potentially poison the cache or bypass authentication. The issue affects requests for root URLs. CVE-2026-93894 Tristan Madani discovered a workspace buffer overflow in the .upper() and .lower() string methods of the Varnish Configuration Language. A remote attacker with knowledge of the active configuration could craft a request which exhausts the remaining workspace during case conversion, causing the worker process to crash and restart, resulting in denial of service. Exploitation depends on the configuration using these methods on attacker-controlled strings and on the applicable request size limits. https://security-tracker.debian.org/tracker/DSA-6584-1

Improvements and security content

• Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1 absolute-form request targets. If the request URL is passed unchecked to a backend which accepts absolute-form URIs, a remote attacker could potentially poison the cache or bypass authentication. The issue affects requests for root URLs. CVE-2026-93894 Tristan Madani discovered a workspace buffer overflow in the .upper() and .lower() string methods of the Varnish Configuration Language. A remote attacker with knowledge of the active configuration could craft a request which exhausts the remaining workspace during case conversion, causing the worker process to crash and restart, resulting in denial of service. Exploitation depends on the configuration using these methods on attacker-controlled strings and on the applicable request size limits. https://security-tracker.debian.org/tracker/DSA-6584-1

Affected products and versions

Recommended action

Review the official publisher document before deployment.

Lifecycle connections

These links connect the publisher update to related Lifecycle records without treating the update publication date as an end-of-support date.

Official publisher evidence