Denial of Service Vulnerability in Varnish Enterprise by Varnish Software

CVE-2026-40395

What is CVE-2026-40395?

Varnish Enterprise versions prior to 6.0.16r12 are vulnerable to a denial of service attack due to a workspace overflow in the headerplus.write_req0() function. This flaw allows malicious clients to exploit shared VCL deployments, resulting in server panic and crashes. The vulnerability arises when the amended req contains excessive header fields, causing the req0 to overflow and disrupt service. It is essential for users to upgrade to the latest version to mitigate the risk of these attacks.

References