CVE-2026-40394
published 2026-04-12CVE-2026-40394: Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.24%
14.5th percentile
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| varnish-software | varnish_cache | >= 9.0.0 < 9.0.1 | 9.0.1 |
| varnish-software | varnish_enterprise | <= 6.0.15 | — |
| varnish-software | varnish_enterprise | — | — |
| vinyl-cache | vinyl_cache | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-26pg-g54q-jv62: Varnish Cache 9 before 9
ghsa_unreviewed·2026-04-12
CVE-2026-40394 [MEDIUM] CWE-670 GHSA-26pg-g54q-jv62: Varnish Cache 9 before 9
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
VulDB
Varnish Cache up to 9.0.0 control flow
vuldb·2026-04-12·CVSS 4.0
CVE-2026-40394 [MEDIUM] Varnish Cache up to 9.0.0 control flow
A vulnerability, which was classified as problematic, was found in Varnish Cache up to 9.0.0. The affected element is an unknown function. Such manipulation leads to incorrect control flow.
This vulnerability is traded as CVE-2026-40394. The attack may be launched remotely. There is no exploit available.
You should upgrade the affected component.
Red Hat
Varnish Cache: Varnish Enterprise: Varnish Cache and Varnish Enterprise: Denial of Service via workspace overflow
vendor_redhat·2026-04-12·CVSS 4.0
CVE-2026-40394 [MEDIUM] CWE-131 Varnish Cache: Varnish Enterprise: Varnish Cache and Varnish Enterprise: Denial of Service via workspace overflow
Varnish Cache: Varnish Enterprise: Varnish Cache and Varnish Enterprise: Denial of Service via workspace overflow
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
A flaw was found in Varnish Cache and Varnish Enterprise. A remote attacker can tri
No detection rules found.
No public exploits indexed.
2026-04-12
Published