PT-2026-32183 · Unknown · Varnish Enterprise+1

Published 2026-04-12 · Updated 2026-04-13 · CVE-2026-40394

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Varnish Cache versions prior to 9.0.1 Varnish Enterprise versions prior to 6.0.16r11

Description Varnish Cache and Varnish Enterprise are susceptible to a denial of service (daemon panic) due to a workspace overflow. This occurs when handling certain amounts of prefetched data during an HTTP/2 session upgrade from HTTP/1. Specifically, the repurposing of an HTTP/1 request as stream zero during the upgrade process can lead to a buffer allocation that splits the workspace. Subsequent fetch operations with pipelining can then exhaust the available workspace.

Recommendations Update Varnish Cache to version 9.0.1 or later. Update Varnish Enterprise to version 6.0.16r11 or later.

Fix

DoS

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2026-40394

Affected Products

Varnish Cache

Varnish Enterprise

References · 9

• https://security-tracker.debian.org/tracker/CVE-2026-40394 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-40394 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-40394 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-40394 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40394 · Security Note
• https://ubuntu.com/security/CVE-2026-40394 · Vendor Advisory
• https://docs.varnish-software.com/security/VEV00002 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2043437751949824367 · Twitter Post
• https://twitter.com/CVEnew/status/2043561042492436507 · Twitter Post