Quick answers
- Is CVE-2026-40396 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-40396 being exploited in the wild.
- How severe is CVE-2026-40396?
- Medium severity, with a CVSS score of 4, published 12 April 2026.
- Which products and versions are affected?
- Varnish Varnish Cache 9.0.0.
- Is there a fix for CVE-2026-40396?
- A patch was published on 2026-04-08: Varnish Cache 9.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-40396 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-40396?
- Check whether you run Vinyl-Cache Vinyl Cache. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A workspace overflow vulnerability exists in Varnish Cache 9.0.0 due to an incorrect control flow implementation during HTTP/1 session handling. The flaw occurs when a client sends an HTTP/1 request and waits for the 'timeout_linger' period to expire (releasing the worker thread) but resumes traffic before 'timeout_idle' closes the session. By sending multiple requests at once during this window, an attacker triggers a pipelining operation. Due to a flawed merge of the non-blocking architecture from Varnish Enterprise, a specific code path fails to perform a complete workspace rollback. This leads to a workspace overflow when prefetched data exceeds the available 'workspace_client' memory, resulting in a daemon panic and crash. The issue is fixed in version 9.0.1.
Affected products
- Varnish Varnish Cache 9.0.0
Timeline
- 2026-04-08: patched: Varnish Cache 9.0.1 released
- 2026-04-12: disclosed: Initial CVE publication
- 2026-04-17: advisory: NVD analysis and enrichment completed