Denial of Service Vulnerability in Varnish Cache by Varnish Software

CVE-2026-40396

What is CVE-2026-40396?

A vulnerability in Varnish Cache 9.0.0 allows for denial of service due to workspace overflow caused by improper management of HTTP/1 requests. When a malicious client exploits the timeout settings and sends multiple requests simultaneously, it can lead to a pipelining operation that triggers a panic, resulting in the Varnish server crashing. This issue stems from conflicts in code adaptation related to workspace management, showing how new implementations can introduce unforeseen vulnerabilities.

References