CVE-2026-40395: varnish-software varnish_enterprise

Vulnerability summary

CVE-2026-40395 is a high (CVSS 7.5) vulnerability in varnish-software varnish_enterprise. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.3% of scored vulnerabilities.

Timeline

1. 12-04-2026
   PublishedVulnerability first disclosed.
2. 13-04-2026
   Last modifiedVulnerability information updated.

Description

Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.