Denial of Service Vulnerability in Varnish Cache by Varnish Software

CVE-2026-40394

What is CVE-2026-40394?

The vulnerability in Varnish Cache versions prior to 9.0.1 and Varnish Enterprise prior to 6.0.16r11 allows for a denial of service due to a 'workspace overflow'. This issue arises when an HTTP/2 session initiates with a speculative HTTP/1 transport, transitioning to h2. During this transition, buffer allocation for sending client frames can disrupt the original workspace. If a high volume of prefetched data is present, subsequent fetch operations may exceed the capacity of the workspace, potentially causing daemon panic.

References