CVE-2026-40394
MEDIUM
4,0
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: none
User Interaction: none
Scope: changed
Confidentiality: none
Integrity: none
Availability: low
Description
AI Translation Available
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a 'workspace overflow' denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0004
Percentile
0,1th
Updated
EPSS Score Trend (Last 4 Days)
670
Always-Incorrect Control Flow Implementation
DraftCommon Consequences
Security Scopes Affected:
Other
Potential Impacts:
Other
Alter Execution Logic
Applicable Platforms
All platforms may be affected
https://docs.varnish-software.com/security/VEV00002/