CVE-2026-40394

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://docs.varnish-software.com/security/VEV00002/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:varnish-software:varnish_enterprise::::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8::::::
	cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9::::::

Configuration 2 (hide)

cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-12 20:16

Updated : 2026-06-17 10:45

NVD link : CVE-2026-40394

Mitre link : CVE-2026-40394

CVE.ORG link : CVE-2026-40394

JSON object : View

Products Affected

varnish-software

varnish_enterprise

vinyl-cache

vinyl_cache

CWE

CWE-670

Always-Incorrect Control Flow Implementation

{"id": "CVE-2026-40394", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40394", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:45:49.035659Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "varnish-software", "product": "Varnish Cache", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-12T20:16:17.857", "references": [{"url": "https://docs.varnish-software.com/security/VEV00002/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace."}], "lastModified": "2026-06-17T10:45:14.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E53A64C0-FC22-40B5-8C3B-6288B44AC3FC", "versionEndIncluding": "6.0.15"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F24D68B5-362E-4797-B6DE-C19A2893186C"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "910BAD01-26E5-4D12-AA23-0BD2D48F229C"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05E529DF-DEE1-4A62-998B-CA312DF888FD"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AB27B34-2951-4755-851C-7C942DAFB6C7"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18A22D42-B038-4E09-92DD-8AFD2F51A340"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE76D616-3AA8-4D9A-9D41-9AE35FE20DBC"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C5610CF-1FE4-4DF8-8D49-7C0CCF0359E4"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27B776B2-9C38-45BE-89E4-ECDEEAE538A9"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED3CA600-C88D-4825-8C36-E052822AF59F"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B1D57B1-9771-4195-9EE3-B26EA776FB6B"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9868204A-88AD-46D2-BE0B-92FF686B7DE4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}