CVE-2026-40395
Workspace Overflow DoS in Varnish Enterprise Shared VCL
Publication date: 2026-04-12
Last updated on: 2026-04-17
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| varnish-software | varnish_enterprise | to 6.0.15 (inc) |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
| varnish-software | varnish_enterprise | 6.0.16 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-40395 is a Denial of Service (DoS) vulnerability in Varnish Enterprise versions before 6.0.16r12 related to shared VCL (Varnish Configuration Language) deployments.
The vulnerability arises from the function headerplus.write_req0() in the vmod_headerplus module, which updates the underlying req0 object. Normally, req0 is the original read-only request from which req is derived and is both readable and writable from VCL.
This function is used in active VCLs to amend req and prepare a refined req0 before switching to a different VCL using the return (vcl(<label>)) action, a mechanism used by the Varnish Controller in shared VCL deployments.
If the amended req contains too many header fields for req0, it causes a workspace overflow that triggers a panic and crashes the Varnish Enterprise server. This can be exploited by malicious clients to perform a Denial of Service attack.
How can this vulnerability impact me? :
This vulnerability can cause the Varnish Enterprise server to crash due to a workspace overflow triggered by too many header fields in a request.
As a result, malicious clients can exploit this flaw to cause a Denial of Service (DoS), making the service unavailable to legitimate users.
What immediate steps should I take to mitigate this vulnerability?
The recommended immediate step to mitigate this vulnerability is to upgrade Varnish Enterprise to version 6.0.16r12 or later, where the issue is resolved.
After upgrading, you should restart the Varnish server to apply the fix.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to a workspace overflow in Varnish Enterprise versions before 6.0.16r12 when using shared VCL deployments with the vmod_headerplus module. Detection involves identifying if your Varnish Enterprise server is running a vulnerable version (6.0.9r5 up to 6.0.16r11) and if the vmod_headerplus module is in use with shared VCL.
To detect the vulnerability on your system, you can check the installed Varnish Enterprise version by running:
- varnishd -V
If the version is within the vulnerable range, it is recommended to upgrade to 6.0.16r12 or later.
To monitor for potential exploitation attempts or crashes caused by this vulnerability, you can check Varnish logs for daemon panics or crashes related to workspace overflow.
Since the vulnerability is triggered by requests with too many header fields, you can use network monitoring tools or packet capture utilities (like tcpdump or Wireshark) to identify suspicious requests with an unusually large number of headers.
Example command to capture HTTP requests with many headers (using tcpdump):
- tcpdump -i <interface> -A 'tcp port 80 or tcp port 443'
Then analyze the captured traffic for requests with excessive headers that might trigger the overflow.
Note: There are no specific commands provided in the resources for direct detection of this vulnerability beyond version checking and monitoring for crashes.