# CVE-2026-40394: Varnish Cache workspace overflow denial of service in HTTP/2 upgrade

Source: https://junglewise.ai/threats/cve-2026-40394-varnish-cache-workspace-overflow-denial-of-service-in-http-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-12. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40394 · Severity: medium · CVSS 4 · Published 2026-04-12

Varnish Cache, a high-performance web accelerator used to speed up websites, is vulnerable to a denial-of-service attack. An attacker can send specifically crafted web traffic that causes the Varnish service to crash (panic), leading to website downtime and service unavailability. This issue affects both the open-source and enterprise versions of the software and can be resolved by upgrading to the latest patched versions.

## Quick answers

**Is CVE-2026-40394 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40394 being exploited in the wild.

**How severe is CVE-2026-40394?** Medium severity, with a CVSS score of 4, published 12 April 2026.

**Which products and versions are affected?** Varnish Software Varnish Cache 9.0.0; Varnish Software Varnish Enterprise 6.0.14r1 through 6.0.16r10.

**Is there a fix for CVE-2026-40394?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-40394 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40394?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A workspace overflow vulnerability exists in Varnish Cache 9.0.0 and Varnish Enterprise 6.0.14r1 through 6.0.16r10 during the upgrade from HTTP/1 to HTTP/2. When a speculative HTTP/1 transport is repurposed as an h2 stream zero, a buffer allocation is made to reserve space for sending frames. This allocation splits the original workspace; if a certain amount of data was prefetched, subsequent pipelining operations may exhaust the remaining workspace, leading to a daemon panic (DoS). The fix involves allocating the send buffer from workspace_thread instead of workspace_client to prevent fragmentation. Patches are available in Varnish Cache 9.0.1 and Varnish Enterprise 6.0.16r11.

## Affected products

- Varnish Software Varnish Cache 9.0.0
- Varnish Software Varnish Enterprise 6.0.14r1 through 6.0.16r10

## Timeline

- 2026-04-09: advisory: Vendor advisory published by Varnish Software
- 2026-04-12: disclosed: CVE published
- 2026-04-17: other: NVD analysis and enrichment completed

## References

- [https://docs.varnish-software.com/security/VEV00002/](https://docs.varnish-software.com/security/VEV00002/)