TI-2026-29164 Aliases CVE-2026-40396 GHSA-5pmq-jgg5-3j6q

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon…

LOW 33CWE-670Published 2026-04-12 · Updated 2026-04-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00347 28th percentileScored 2026-11-07

Fix Fixed Varnish Cache (varnish-software): 9.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
varnish-software	Varnish Cache	9.0.0 to before 9.0.1	9.0.1	Patch available	CNA

Varnish Cache Vendorvarnish-software Affected 9.0.0 to before 9.0.1 Fixed in 9.0.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:::::::*	9.0.0	Vulnerable	Vinyl-Cache

cpe:2.3:a:vinyl-cache:vinyl_cache:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Vinyl-Cache

Remediation

Fix · CNA Varnish Cache (varnish-software) Fixed in 9.0.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-04-12
varnish-software Varnish Cache 9.0.1
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-29162 Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace…Priority LOW 32
Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 3 products

Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2026-40396
2026-10-03 Alias added: GHSA-5pmq-jgg5-3j6q

References

Other 2

TI-2025-07937 A mismatch caused by client-triggered server-sent stream resets between HTTP/2… CVSS 3.1HIGH 7.5
TI-2022-07931 In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10… CVSS 3.1CRITICAL 9.1
TI-2019-11944 An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before… CVSS 3.0HIGH 7.5
TI-2026-26733 Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked… CVSS 3.1CRITICAL 9.8
TI-2022-22151 An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11… CVSS 3.1HIGH 7.5
TI-2020-09351 An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3… CVSS 3.1HIGH 7.5

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences