Executive brief
Varnish Cache is a high-performance web accelerator used to speed up websites by caching content. A vulnerability in version 9.0.0 allows a remote attacker to crash the server by sending specifically timed web requests. This results in a denial-of-service (DoS) condition, making the hosted websites or applications unavailable to users until the service is restarted.
Technical details
A workspace overflow vulnerability exists in Varnish Cache 9.0.0 due to an incorrect control flow implementation during HTTP/1 session handling. The flaw occurs when a client sends an HTTP/1 request and waits for the 'timeout_linger' period to expire (releasing the worker thread) but resumes traffic before 'timeout_idle' closes the session. By sending multiple requests at once during this window, an attacker triggers a pipelining operation. Due to a flawed merge of the non-blocking architecture from Varnish Enterprise, a specific code path fails to perform a complete workspace rollback. This leads to a workspace overflow when prefetched data exceeds the available 'workspace_client' memory, resulting in a daemon panic and crash. The issue is fixed in version 9.0.1.
Affected products
- Varnish Varnish Cache 9.0.0
Timeline
- 2026-04-08: patched: Varnish Cache 9.0.1 released
- 2026-04-12: disclosed: Initial CVE publication
- 2026-04-17: advisory: NVD analysis and enrichment completed