CVE-2026-40396 Denial of service in Varnish Cache
A malicious client can trigger a workspace overflow and crash the Varnish Cache server by exploiting HTTP/1 request pipelining timing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40396?
CVE-2026-40396 is a medium-severity denial of service vulnerability in varnish-software Varnish Cache, published on 12 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.
Weakness: CWE-670
Which versions are affected by CVE-2026-40396?
It affects 1 product.
Products include Vinyl-Cache Vinyl Cache.
How do I fix CVE-2026-40396?
No fix has been published for CVE-2026-40396 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-40396 being exploited?
There is no known exploitation of CVE-2026-40396 in the wild and no public exploit code.
Sources
Also known as GHSA-5pmq-jgg5-3j6q, UBUNTU-CVE-2026-40396.