CVE-2026-40396: DoS in Varnish Cache 9.0.0-9.0.1

An attacker can exploit this vulnerability by sending a carefully crafted sequence of HTTP/1 requests. The attacker initiates an HTTP/1 request, waits for the session's worker thread to release (timeoutlinger), and then resumes traffic before the session closes (timeoutidle), sending multiple requests concurrently. This pipelining operation triggers a workspace overflow, leading to a daemon panic and a denial of service. The impact is a complete disruption of the Varnish Cache service, preventing legitimate users from accessing cached content. This can lead to significant performance degradation and potential service outages, especially in environments heavily reliant on Varnish for content delivery.

1. Reserved2026-04-12
2. Published2026-04-12
3. Modified2026-04-13
4. EPSS updated2026-04-20

The primary mitigation for CVE-2026-40396 is to upgrade Varnish Cache to version 9.0.1 or later, which contains the fix. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing temporary workarounds. While no direct configuration workaround exists to completely prevent the vulnerability, limiting the number of concurrent requests a client can make might reduce the likelihood of triggering the overflow. Monitor Varnish Cache logs for unusual patterns of requests that could indicate exploitation attempts. After upgrading, confirm the fix by sending a series of rapid HTTP/1 requests and verifying that the Varnish Cache service remains stable and does not experience daemon panics.