CVE-2026-40394: Varnish Cache DoS Vulnerability

CVE-2026-40394 Overview

CVE-2026-40394 is a denial of service vulnerability affecting Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11. The vulnerability allows attackers to trigger a "workspace overflow" condition that results in a daemon panic. This occurs due to improper handling of workspace allocation during the HTTP/1 to HTTP/2 upgrade process, particularly when specific amounts of prefetched data are present.

Critical Impact

Remote attackers can cause service disruption by triggering a daemon panic through crafted HTTP/2 session upgrades, potentially affecting availability of web applications relying on Varnish Cache as a reverse proxy.

Affected Products

• Varnish Cache 9 before version 9.0.1
• Varnish Enterprise before version 6.0.16r11

Discovery Timeline

• 2026-04-12 - CVE-2026-40394 published to NVD
• 2026-04-13 - Last updated in NVD database

Technical Details for CVE-2026-40394

Vulnerability Analysis

This vulnerability stems from CWE-670 (Always-Incorrect Control Flow Implementation) and manifests during the HTTP/2 session establishment process in Varnish Cache. When an HTTP/2 session is initialized, Varnish starts with a speculative HTTP/1 transport mechanism. Upon upgrading to HTTP/2 (h2), the original HTTP/1 request is repurposed as stream zero within the HTTP/2 context.

The critical flaw occurs during this upgrade phase: a buffer allocation is performed to reserve space for sending frames to the client. This allocation splits the original workspace memory region. Depending on the amount of data that has been prefetched before the upgrade occurs, subsequent fetch operations may attempt pipelining that exhausts the available workspace memory, leading to a daemon panic.

The network-accessible nature of this vulnerability means it can be exploited remotely without authentication, though the attack complexity is higher due to the specific conditions required involving prefetched data amounts.

Root Cause

The root cause is improper control flow handling (CWE-670) in the workspace memory management during HTTP protocol upgrades. The workspace allocation logic fails to properly account for scenarios where the combination of the buffer reservation for HTTP/2 frame transmission and existing prefetched data exceeds the available workspace capacity. This always-incorrect control flow leads to a predictable crash condition when specific data amounts trigger the overflow.

Attack Vector

The attack vector is network-based, exploiting the HTTP/2 upgrade mechanism. An attacker can potentially trigger this condition by:

1. Initiating an HTTP/1 connection to a Varnish Cache server
2. Sending requests that result in specific amounts of prefetched data
3. Triggering an upgrade to HTTP/2
4. Causing the workspace split to create insufficient remaining space
5. Forcing a subsequent fetch operation that attempts pipelining

The vulnerability requires no authentication or user interaction, but the precise conditions involving prefetched data amounts increase the attack complexity.

The vulnerability mechanism involves workspace memory management during the HTTP/1 to HTTP/2 protocol upgrade. When the speculative HTTP/1 transport upgrades to HTTP/2, the buffer allocation for client frame transmission splits the workspace. If prefetched data is at certain thresholds, subsequent pipelining operations will exhaust workspace memory. For complete technical details, see the Varnish Security Advisory VEV00002.

Detection Methods for CVE-2026-40394

Indicators of Compromise

• Varnish Cache daemon crash logs indicating workspace overflow or panic conditions
• Unexpected service restarts or daemon failures correlating with HTTP/2 traffic patterns
• Error messages in Varnish logs referencing workspace exhaustion during protocol upgrades

Detection Strategies

• Monitor Varnish daemon logs for panic events and workspace-related error messages
• Implement alerting on unexpected Varnish service restarts or crashes
• Analyze HTTP/2 traffic patterns for anomalous upgrade sequences that precede service disruptions
• Deploy network monitoring to detect potential exploitation attempts targeting HTTP/2 handshakes

Monitoring Recommendations

• Enable verbose logging for HTTP/2 session handling in Varnish configurations
• Implement health checks that detect daemon availability and restart frequency
• Set up dashboards to track workspace utilization metrics if exposed by Varnish
• Configure automated alerting for any daemon panic events in production environments

How to Mitigate CVE-2026-40394

Immediate Actions Required

• Upgrade Varnish Cache to version 9.0.1 or later immediately
• Upgrade Varnish Enterprise to version 6.0.16r11 or later
• Review system logs for any evidence of prior exploitation attempts
• Consider temporarily disabling HTTP/2 support if immediate patching is not possible

Patch Information

Varnish Software has released patches addressing this workspace overflow vulnerability. Organizations should upgrade to Varnish Cache 9.0.1 or Varnish Enterprise 6.0.16r11 to remediate this issue. Detailed patch information and security guidance can be found in the Varnish Security Advisory VEV00002.

Workarounds

• Disable HTTP/2 support temporarily by removing or modifying the h2 feature flag in Varnish configuration until patching is complete
• Implement rate limiting on incoming connections to reduce potential exploitation surface
• Deploy a web application firewall (WAF) in front of Varnish to filter potentially malicious HTTP/2 upgrade attempts
• Consider limiting prefetch operations or adjusting workspace size parameters as an interim measure (consult Varnish documentation for appropriate values)

# Temporary workaround: Disable HTTP/2 in Varnish VCL
# Add to your VCL configuration to force HTTP/1.1 only
# Note: This reduces functionality but mitigates the vulnerability

# In vcl_recv, you can reject HTTP/2 connections
# Consult Varnish documentation for your specific version
# Recommended: Apply official patch instead of workarounds