FKIE_CVE-2026-40394

Vulnerability from fkie_nvd - Published: 2026-04-12 20:16 - Updated: 2026-04-17 14:35
Severity ?
4.0 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
References
cve@mitre.orghttps://docs.varnish-software.com/security/VEV00002/Vendor Advisory
Impacted products
Vendor Product Version
varnish-software varnish_enterprise *
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
varnish-software varnish_enterprise 6.0.16
vinyl-cache vinyl_cache 9.0.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E53A64C0-FC22-40B5-8C3B-6288B44AC3FC",
              "versionEndIncluding": "6.0.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*",
              "matchCriteriaId": "F24D68B5-362E-4797-B6DE-C19A2893186C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*",
              "matchCriteriaId": "910BAD01-26E5-4D12-AA23-0BD2D48F229C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*",
              "matchCriteriaId": "05E529DF-DEE1-4A62-998B-CA312DF888FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*",
              "matchCriteriaId": "8AB27B34-2951-4755-851C-7C942DAFB6C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*",
              "matchCriteriaId": "18A22D42-B038-4E09-92DD-8AFD2F51A340",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*",
              "matchCriteriaId": "FE76D616-3AA8-4D9A-9D41-9AE35FE20DBC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*",
              "matchCriteriaId": "9C5610CF-1FE4-4DF8-8D49-7C0CCF0359E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*",
              "matchCriteriaId": "27B776B2-9C38-45BE-89E4-ECDEEAE538A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*",
              "matchCriteriaId": "ED3CA600-C88D-4825-8C36-E052822AF59F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*",
              "matchCriteriaId": "6B1D57B1-9771-4195-9EE3-B26EA776FB6B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "9868204A-88AD-46D2-BE0B-92FF686B7DE4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace."
    }
  ],
  "id": "CVE-2026-40394",
  "lastModified": "2026-04-17T14:35:23.607",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "cve@mitre.org",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-04-12T20:16:17.857",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://docs.varnish-software.com/security/VEV00002/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-670"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.