Read the docs
TI-2026-29162 Aliases CVE-2026-40394GHSA-26pg-g54q-jv62

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace…

Priority LOW 32CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00236 14th percentileScored 2026-11-07
Fix Fixed Varnish Cache (varnish-software): 9.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
varnish-softwareVarnish Cache9.0.0 to before 9.0.19.0.1Patch availableCNA
  • Varnish Cache Vendorvarnish-software Affected 9.0.0 to before 9.0.1 Fixed in 9.0.1 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*up to 6.0.15Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*6.0.16 r1Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*6.0.16 r10Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*6.0.16 r2Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*6.0.16 r3Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*6.0.16 r4Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*6.0.16 r5Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*6.0.16 r6Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*6.0.16 r7Vulnerablevarnish-software
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*6.0.16 r8Vulnerablevarnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:* Versions up to 6.0.15 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:* Versions 6.0.16 r1 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:* Versions 6.0.16 r10 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:* Versions 6.0.16 r2 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:* Versions 6.0.16 r3 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:* Versions 6.0.16 r4 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:* Versions 6.0.16 r5 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:* Versions 6.0.16 r6 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:* Versions 6.0.16 r7 Vulnerable ·varnish-software
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:* Versions 6.0.16 r8 Vulnerable ·varnish-software
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*6.0.16 r9Vulnerablevarnish-software
cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:*9.0.0VulnerableVinyl-Cache
  • cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:* Versions 6.0.16 r9 Vulnerable ·varnish-software
  • cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Vinyl-Cache

Remediation

  • Fix · CNA Varnish Cache (varnish-software) Fixed in 9.0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    varnish-software Varnish Cache 9.0.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-29164 Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon…Priority LOW 33
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40394
  2. 2026-10-03 Alias added: GHSA-26pg-g54q-jv62

References

Advisory 1

  • TI-2026-26733 Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked… CVSS 3.1CRITICAL 9.8
  • TI-2023-21726 libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an… CVSS 3.1MEDIUM 6.5
  • TI-2025-21653 Out-of-bounds read in varnish-software Varnish Enterprise CVSS 3.1HIGH 7.5
  • TI-2026-29163 Resource allocation without limits in varnish-software Varnish Enterprise CVSS 3.1HIGH 7.5
  • TI-2025-21652 Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests. CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences