# CVE-2026-40396: Varnish Cache workspace overflow denial of service in HTTP/1 pipelining

Source: https://junglewise.ai/threats/cve-2026-40396-varnish-cache-workspace-overflow-denial-of-service-in-http-1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-12. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2026-40396 · Severity: medium · CVSS 4 · Published 2026-04-12

Varnish Cache is a high-performance web accelerator used to speed up websites by caching content. A vulnerability in version 9.0.0 allows a remote attacker to crash the server by sending specifically timed web requests. This results in a denial-of-service (DoS) condition, making the hosted websites or applications unavailable to users until the service is restarted.

Technologies: [Vinyl-Cache Vinyl Cache](https://junglewise.ai/threats/technologies/vinyl-cache). Vendors: [Vinyl-Cache](https://junglewise.ai/threats/vendors/vinyl-cache).

## Quick answers

**Is CVE-2026-40396 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40396 being exploited in the wild.

**How severe is CVE-2026-40396?** Medium severity, with a CVSS score of 4, published 12 April 2026.

**Which products and versions are affected?** Varnish Varnish Cache 9.0.0.

**Is there a fix for CVE-2026-40396?** A patch was published on 2026-04-08: Varnish Cache 9.0.1 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40396 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-40396?** Check whether you run Vinyl-Cache Vinyl Cache. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A workspace overflow vulnerability exists in Varnish Cache 9.0.0 due to an incorrect control flow implementation during HTTP/1 session handling. The flaw occurs when a client sends an HTTP/1 request and waits for the 'timeout_linger' period to expire (releasing the worker thread) but resumes traffic before 'timeout_idle' closes the session. By sending multiple requests at once during this window, an attacker triggers a pipelining operation. Due to a flawed merge of the non-blocking architecture from Varnish Enterprise, a specific code path fails to perform a complete workspace rollback. This leads to a workspace overflow when prefetched data exceeds the available 'workspace_client' memory, resulting in a daemon panic and crash. The issue is fixed in version 9.0.1.

## Affected products

- Varnish Varnish Cache 9.0.0

## Timeline

- 2026-04-08: patched: Varnish Cache 9.0.1 released
- 2026-04-12: disclosed: Initial CVE publication
- 2026-04-17: advisory: NVD analysis and enrichment completed

## References

- [https://github.com/varnish/varnish/issues/15](https://github.com/varnish/varnish/issues/15)
- [https://github.com/varnish/varnish/releases/tag/varnish-9.0.1](https://github.com/varnish/varnish/releases/tag/varnish-9.0.1)

## Related threats

- [Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle…](https://junglewise.ai/threats/cve-2026-34475-varnish-cache-before-8-0-1-and-varnish-enterprise-before-6-0)