{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-40396 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-40396 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-40396 is a medium-severity denial of service vulnerability in varnish-software Varnish Cache, published on 12 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-40396 and fix it if it is affected.\n\nWhat it is: CVE-2026-40396 is a medium-severity denial of service vulnerability in varnish-software Varnish Cache, published on 12 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-40396 in the wild and no public exploit code.\n\nAffected product: varnish-software Varnish Cache. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-40396/ (Markdown: https://insights.sbomify.com/CVE-2026-40396/index.md)","id":"CVE-2026-40396","markdown":"https://insights.sbomify.com/CVE-2026-40396/index.md","name":"CVE-2026-40396","record":{"aliases":["GHSA-5pmq-jgg5-3j6q","UBUNTU-CVE-2026-40396"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Varnish Cache","requires_auth":"none","summary":"A malicious client can trigger a workspace overflow and crash the Varnish Cache server by exploiting HTTP/1 request pipelining timing.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"vinyl_cache","vendor":"vinyl-cache"}],"cvss":{"score":4,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-670","name":"Always-Incorrect Control Flow Implementation"}],"description":"Varnish Cache 9 before 9.0.1 allows a \"workspace overflow\" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Denial of service in Varnish Cache","id":"CVE-2026-40396","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"Windows Common Log File System Driver Elevation of Privilege Vulnerability","id":"CVE-2026-40397"},"packages":[],"prev":{"headline":"Denial of service in Varnish Enterprise","id":"CVE-2026-40395"},"products":["Varnish Cache"],"published":"2026-04-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-04-13","vendors":["varnish-software"]},"summary":"A malicious client can trigger a workspace overflow and crash the Varnish Cache server by exploiting HTTP/1 request pipelining timing.","url":"https://insights.sbomify.com/CVE-2026-40396/"}