CVE catalog

CVE-2026-40396

Varnish Cache 9 before 9.0.1 allows a "workspace…

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.

Severity: Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Apr 12, 2026, 7:23:03 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.35% · Oct 27, 2026

Projects and upstream resources

[varnish][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "varnish",
      "status": "not affected",
      "release": "trixie",
      "version": "7.7.0-3+deb13u1"
    },
    {
      "name": "varnish",
      "status": "not affected",
      "release": "trixie-security",
      "version": "7.7.0-3+deb13u2"
    },
    {
      "name": "varnish",
      "status": "not affected",
      "release": "bookworm",
      "version": "7.1.1-2+deb12u1"
    },
    {
      "name": "varnish",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "7.1.1-2+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "varnish",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "unimportant",
      "fixed_version": "0"
    },
    {
      "bug": null,
      "name": "varnish",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "vinyl_cache",
      "ecosystem": "cpe",
      "fixed_version": ""
    },
    {
      "name": "vinyl_cache",
      "ranges": [],
      "ecosystem": "cpe",
      "fixed_version": "",
      "provider_record_id": "NVD-CVE-2026-40396"
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[libvarnishapi3]Unknown
Source package: [varnish]
Details (4)
- 7.1.1-2+deb12u1 · amd64 · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · amd64 · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
[libvarnishapi-dev]Unknown
Source package: [varnish]
Details (4)
- 7.1.1-2+deb12u1 · amd64 · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · amd64 · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
[varnish]Unknown
Details (4)
- 7.1.1-2+deb12u1 · amd64 · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · amd64 · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · arm64 · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
[varnish-doc]Unknown
Source package: [varnish]
Details (4)
- 7.1.1-2+deb12u1 · all · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · all · bookworm
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · all · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm
- 7.1.1-2+deb12u1 · all · bookworm-security
  Not affected
  nvd · varnish · debian · bookworm

Observed: Oct 27, 2026, 7:59:11 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]