CVE-2026-40396

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2026-40396", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-04-12T19:23:00.553Z", "datePublished": "2026-04-12T19:23:03.408Z", "dateUpdated": "2026-04-13T15:35:43.858Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Varnish Cache", "vendor": "varnish-software", "versions": [{"lessThan": "9.0.1", "status": "affected", "version": "9.0.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Varnish Cache 9 before 9.0.1 allows a \"workspace overflow\" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-670", "description": "CWE-670 Always-Incorrect Control Flow Implementation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-12T19:34:04.613Z"}, "references": [{"url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1"}, {"url": "https://github.com/varnish/varnish/issues/15"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "versionStartIncluding": "9.0.0", "versionEndExcluding": "9.0.1"}]}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T15:35:30.690667Z", "id": "CVE-2026-40396", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T15:35:43.858Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "varnish-software", "product": "Varnish Cache", "versions": [{"status": "affected", "version": "9.0.0", "lessThan": "9.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1"}, {"url": "https://github.com/varnish/varnish/issues/15"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Varnish Cache 9 before 9.0.1 allows a \"workspace overflow\" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-670", "description": "CWE-670 Always-Incorrect Control Flow Implementation"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "9.0.1", "versionStartIncluding": "9.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-04-12T19:34:04.613Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40396", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T15:35:30.690667Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-13T15:35:38.198Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-40396", "state": "PUBLISHED", "dateUpdated": "2026-04-12T19:34:04.613Z", "dateReserved": "2026-04-12T19:23:00.553Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-04-12T19:23:03.408Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Varnish Cache", "vendor": "varnish-software", "versions": [{"lessThan": "9.0.1", "status": "affected", "version": "9.0.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "9868204A-88AD-46D2-BE0B-92FF686B7DE4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Varnish Cache 9 before 9.0.1 allows a \"workspace overflow\" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server."}, {"lang": "es", "value": "Varnish Cache 9 anterior a la 9.0.1 permite una \u2019sobrecarga de espacio de trabajo\u2019 (workspace overflow) denegaci\u00f3n de servicio (p\u00e1nico del demonio) despu\u00e9s de timeout_linger. Un cliente malicioso podr\u00eda enviar una solicitud HTTP/1, esperar el tiempo suficiente hasta que la sesi\u00f3n libere su hilo de trabajo (timeout_linger) y reanudar el tr\u00e1fico antes de que la sesi\u00f3n se cierre (timeout_idle) enviando m\u00e1s de una solicitud a la vez para activar una operaci\u00f3n de pipelining entre solicitudes. Esta vulnerabilidad que afecta a Varnish Cache 9.0.0 surgi\u00f3 de una adaptaci\u00f3n de la arquitectura no bloqueante de Varnish Enterprise para HTTP/2. Se necesit\u00f3 c\u00f3digo nuevo para adaptarse a una API de espacio de trabajo m\u00e1s reciente que formaliza la operaci\u00f3n de pipelining. Adem\u00e1s del cambio en el espacio de trabajo por parte de Varnish Cache, otras diferencias crearon conflictos de fusi\u00f3n, como el soporte parcial para trailers en Varnish Enterprise. La resoluci\u00f3n de conflictos omiti\u00f3 una ruta de c\u00f3digo que configuraba el pipelining para realizar una reversi\u00f3n completa del espacio de trabajo, perdiendo la garant\u00eda de que los datos precargados cabr\u00edan dentro de workspace_client durante la transici\u00f3n de una solicitud a la siguiente. Esto puede resultar en una sobrecarga del espacio de trabajo (workspace overflow), lo que desencadena un p\u00e1nico y provoca la ca\u00edda del servidor Varnish."}], "id": "CVE-2026-40396", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40396", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T15:35:30.690667Z", "version": "2.0.3"}}]}, "published": "2026-04-12T20:16:19.057", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking"], "url": "https://github.com/varnish/varnish/issues/15"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/varnish/varnish/releases/tag/varnish-9.0.1"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-670"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "varnish: Varnish Cache: Denial of Service via workspace overflow during HTTP/1 pipelining", "id": "2457697", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457697"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-131", "details": ["A flaw was found in Varnish Cache. A malicious client can exploit a 'workspace overflow' vulnerability by sending an HTTP/1 request, waiting for the session to release its worker thread, and then resuming traffic with multiple requests to trigger a pipelining operation. This can lead to a workspace overflow, causing the Varnish server to panic and crash, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-40396", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "varnish", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "varnish:6/varnish", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "varnish", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-12T19:23:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-40396\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40396\nhttps://github.com/varnish/varnish/issues/15\nhttps://github.com/varnish/varnish/releases/tag/varnish-9.0.1"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.0.1)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Varnish Cache", "source": "cna", "vendor": "varnish-software"}, "product": "varnish_cache", "vendor": "varnish-software"}], "analysis": {"en": {"generated_at": "2026-04-14T01:38:34.207831+00:00", "value": {"mitigation_remediation": ["Upgrade to Varnish Cache 9.0.1 or later", "Verify the update and monitor for daemon panics", "If upgrade is delayed, limit or disable HTTP/1 pipelining and adjust timeout settings, then monitor", "Stay alert for further advisories from Varnish Software"], "summary": {"action": "Immediate Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The affected vendor is Varnish Software, product Varnish Cache. Versions 9.0.0 through any earlier build of 9.0.1 are vulnerable. The issue appears only in the 9.x series before the 9.0.1 release that addressed the workspace API adaptation. Systems running these versions and exposed to Internet clients that can send HTTP/1 pipelined requests are at risk.", "description_and_impact": "Varnish Cache 9 before 9.0.1 permits a workspace overflow that leads to a daemon panic when a client performs HTTP/1 pipelining after a timeout. The overflow occurs because the prefetched data from one request may exceed the new workspace_client size during transition, causing a panic. This results in an abrupt service shutdown, denying availability to all users. The flaw is linked to improper buffer size handling (CWE-131) and synchronization errors (CWE-670). No remote code execution is possible; the attack is limited to causing a denial of service.", "risk_and_exploitability": "The CVSS score of 4 denotes a medium impact on availability. EPSS reports less than 1% likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack likely originates from a remote client that can maintain a persistent connection and send a pipelined request after exploiting the timeout_linger behavior; the required conditions are publicly reachable HTTP/1 interfaces and unpatched Varnish Cache versions. Given the low exploitation probability and the nature of the attack, the overall risk is moderate, but the impact on availability can be severe for critical services."}}}}, "created": "2026-04-13T12:38:12.599324+00:00", "updated": "2026-04-14T16:36:11.085875+00:00", "vendors": ["varnish-software", "varnish-software$PRODUCT$varnish_cache"]}