CVE-2026-40395

Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.

• CWE-770

• https://docs.varnish-software.com/security/VEV00003/Vendor Advisory

Published

Apr 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40384An improper validation of the search parameter of the com_me…7.5
• CVE-2026-40385In libexif through 0.6.25, an unsigned 32bit integer overflo…7.1
• CVE-2026-40386In libexif through 0.6.25, an integer underflow in size chec…7.1
• CVE-2026-4039A vulnerability was determined in OpenClaw 2026.2.19-2. This…8.8
• CVE-2026-40393In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds me…9.8
• CVE-2026-40394Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6…7.5
• CVE-2026-40396Varnish Cache 9 before 9.0.1 allows a "workspace overflow" d…7.5
• CVE-2026-40397Heap-based buffer overflow in Windows Common Log File System…7.8
• CVE-2026-40398Heap-based buffer overflow in Windows Remote Desktop allows …7.8
• CVE-2026-40399Concurrent execution using shared resource with improper syn…7.8
• CVE-2026-4040A vulnerability was identified in OpenClaw up to 2026.2.17. …5.5
• CVE-2026-40400Relative path traversal in Windows PowerShell allows an auth…8