Is CVE-2026-40394 actively exploited?

CVE-2026-40394 has no public evidence of in-the-wild exploitation as of 2026-04-17.

What is the CVSS score for CVE-2026-40394?

CVE-2026-40394 has a CVSS score of 4 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L.

How do I patch CVE-2026-40394?

Patch guidance is available from varnish-software security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-40394.

CVE-2026-40394 - remediation guidance & executive summary

Q: Which products are affected by CVE-2026-40394?

12 products: varnish-software varnish enterprise, varnish-software varnish enterprise, varnish-software varnish enterprise, varnish-software varnish enterprise, varnish-software varnish enterprise, and 7 more.

Description

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Attack Vector: network
Complexity: high
Privileges: none
User Action: none
Scope: changed
Confidentiality: none
Integrity: none
Availability: low
Weaknesses: CWE-670

Metadata

Primary Vendor: VARNISH-SOFTWARE
Published: 4/12/2026
Last Modified: 4/17/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

varnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevarnish-software : varnish_enterprisevinyl-cache : vinyl_cache

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-40394. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-40394

View on NIST NVD

CVE-2026-40394 vulnerability