Varnish software's caching engine fails to properly normalize request URLs that contain a forward‑slash path when serving HTTP/1.1 traffic. As a result, an attacker can craft a request that causes the proxy to cache or serve content that it would normally treat as distinct to other clients. This flaw can be leveraged to inject false cache entries or to bypass authentication mechanisms that rely on cache validation, potentially allowing unauthorized access to protected content.

Varnish Cache versions prior to 8.0.1 and Varnish Enterprise prior to 6.0.16r12 are affected. Only these legacy releases are at risk; newer releases are not vulnerable.

The vulnerability carries a CVSS score of 5.4, indicating moderate risk, and has an EPSS score of less than 1 %, suggesting a low probability of mass exploitation. It is not currently listed in the CISA KEV catalog. Exploitation requires remote delivery of a crafted HTTP/1.1 request targeting the vulnerable server, which an attacker can easily embed in malicious traffic. The impact, however, is limited to the realm of cache poisoning and authentication bypass for requests that trigger the unchecked URL handler.