CVE-2026-40396 — Always-Incorrect Control Flow Implementation in Varnish Cache

CWE-670 — Always-Incorrect Control Flow ImplementationCWE-131 — Incorrect Calculation of Buffer Size6 documents6 sources
Severity
4.0MEDIUMNVD
EPSS
0.0%
top 98.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Varnish-software Varnish Cache
Timeline
PublishedApr 12

Description

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocki…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:LExploitability: 2.2 | Impact: 1.4

Affected Packages1 packages

▶CVEListV5varnish-software/varnish_cache9.0.0 — 9.0.1

🔴Vulnerability Details

3
GHSA
GHSA-5pmq-jgg5-3j6q: Varnish Cache 9 before 9↗2026-04-12
▶
CVEList
CVE-2026-40396: Varnish Cache 9 before 9↗2026-04-12
▶
VulDB
varnish-software Varnish Cache up to 9.0.0 timeout_linger control flow↗2026-04-12
▶

📋Vendor Advisories

1
Red Hat
varnish: Varnish Cache: Denial of Service via workspace overflow during HTTP/1 pipelining↗2026-04-12
▶

💬Community

1
Bugzilla
CVE-2026-40396 varnish: Varnish Cache: Denial of Service via workspace overflow during HTTP/1 pipelining↗2026-04-12
▶
CVE-2026-40396 — Varnish Cache vulnerability | cvebase