# CVE-2026-40396: Denial of service in Varnish Cache

> A malicious client can trigger a workspace overflow and crash the Varnish Cache server by exploiting HTTP/1 request pipelining timing.

- **Severity:** Medium 4.0 (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L`)
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 12 Apr 2026
- **Updated:** 13 Apr 2026
- **Also known as:** GHSA-5pmq-jgg5-3j6q, UBUNTU-CVE-2026-40396

## What is CVE-2026-40396?

CVE-2026-40396 is a medium-severity denial of service vulnerability in varnish-software Varnish Cache, published on 12 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

### Official description

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.

Weakness: CWE-670 (Always-Incorrect Control Flow Implementation)

## Which versions are affected by CVE-2026-40396?

It affects 1 product.


Products: Vinyl-Cache Vinyl Cache.

## How do I fix CVE-2026-40396?

No fix has been published for CVE-2026-40396 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-40396 being exploited?

There is no known exploitation of CVE-2026-40396 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-40396 and fix it if it is affected.

What it is: CVE-2026-40396 is a medium-severity denial of service vulnerability in varnish-software Varnish Cache, published on 12 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-40396 in the wild and no public exploit code.

Affected product: varnish-software Varnish Cache. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-40396/ (Markdown: https://insights.sbomify.com/CVE-2026-40396/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-40396
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-40396
- OSV: https://osv.dev/vulnerability/CVE-2026-40396

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-40396/
Summaries are generated and may contain mistakes; the official description above is the record.