Several vulnerabilities were discovered in Varnish Cache, an HTTP accelerator, which could result in cache poisoning, authentication bypass or denial of service. CVE-2026-34475 Tom Kinnaird discovered a deficiency in the parsing of HTTP/1.1 absolute-form request targets. If the request URL is passed unchecked to a backend which accepts absolute-form URIs, a remote attacker could potentially poison the cache or bypass authentication. The issue affects requests for root URLs. CVE-2026-93894 Tristan Madani discovered a workspace buffer overflow in the .upper() and .lower() string methods of the Varnish Configuration Language. A remote attacker with knowledge of the active configuration could cr