CVE-2026-40394

{"id": "CVE-2026-40394", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40394", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:45:49.035659Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "varnish-software", "product": "Varnish Cache", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-12T20:16:17.857", "references": [{"url": "https://docs.varnish-software.com/security/VEV00002/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-670"}]}], "descriptions": [{"lang": "en", "value": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace."}, {"lang": "es", "value": "Varnish Cache 9 anterior a la versi\u00f3n 9.0.1 y Varnish Enterprise anterior a la versi\u00f3n 6.0.16r11 permiten una denegaci\u00f3n de servicio por \u2019desbordamiento de espacio de trabajo\u2019 (p\u00e1nico del demonio) para ciertas cantidades de datos precargados. La configuraci\u00f3n de una sesi\u00f3n HTTP/2 comienza con un transporte HTTP/1 especulativo, y al actualizar a h2, la solicitud HTTP/1 se reutiliza como flujo cero. Durante la actualizaci\u00f3n, se realiza una asignaci\u00f3n de b\u00fafer para reservar espacio para enviar tramas al cliente. Esta asignaci\u00f3n dividir\u00eda el espacio de trabajo original y, dependiendo de la cantidad de datos precargados, la siguiente recuperaci\u00f3n podr\u00eda realizar una operaci\u00f3n de pipelining que agotar\u00eda el espacio de trabajo."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E53A64C0-FC22-40B5-8C3B-6288B44AC3FC", "versionEndIncluding": "6.0.15"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F24D68B5-362E-4797-B6DE-C19A2893186C"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "910BAD01-26E5-4D12-AA23-0BD2D48F229C"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05E529DF-DEE1-4A62-998B-CA312DF888FD"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8AB27B34-2951-4755-851C-7C942DAFB6C7"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "18A22D42-B038-4E09-92DD-8AFD2F51A340"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE76D616-3AA8-4D9A-9D41-9AE35FE20DBC"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C5610CF-1FE4-4DF8-8D49-7C0CCF0359E4"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27B776B2-9C38-45BE-89E4-ECDEEAE538A9"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ED3CA600-C88D-4825-8C36-E052822AF59F"}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B1D57B1-9771-4195-9EE3-B26EA776FB6B"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9868204A-88AD-46D2-BE0B-92FF686B7DE4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}