Executive brief
Varnish Cache, a high-performance web accelerator used to speed up websites, is vulnerable to a denial-of-service attack. An attacker can send specifically crafted web traffic that causes the Varnish service to crash (panic), leading to website downtime and service unavailability. This issue affects both the open-source and enterprise versions of the software and can be resolved by upgrading to the latest patched versions.
Technical details
A workspace overflow vulnerability exists in Varnish Cache 9.0.0 and Varnish Enterprise 6.0.14r1 through 6.0.16r10 during the upgrade from HTTP/1 to HTTP/2. When a speculative HTTP/1 transport is repurposed as an h2 stream zero, a buffer allocation is made to reserve space for sending frames. This allocation splits the original workspace; if a certain amount of data was prefetched, subsequent pipelining operations may exhaust the remaining workspace, leading to a daemon panic (DoS). The fix involves allocating the send buffer from workspace_thread instead of workspace_client to prevent fragmentation. Patches are available in Varnish Cache 9.0.1 and Varnish Enterprise 6.0.16r11.
Affected products
- Varnish Software Varnish Cache 9.0.0
- Varnish Software Varnish Enterprise 6.0.14r1 through 6.0.16r10
Timeline
- 2026-04-09: advisory: Vendor advisory published by Varnish Software
- 2026-04-12: disclosed: CVE published
- 2026-04-17: other: NVD analysis and enrichment completed