High
varnish — security advisory
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
- Products
- varnish
- Affected versions
- 3.0.4-1ubuntu1, 3.0.4-1ubuntu2, 3.0.5-1ubuntu2, 3.0.5-2, 3.0.5-2ubuntu0.1, 4.0.3-1, 4.1.0-1, 4.1.0-2, 4.1.1-1, 4.1.1-1ubuntu0.2, 4.1.1-1ubuntu0.2+esm1, 5.0.0-7.1, 5.2.1-1, 5.2.1-1ubuntu0.1, 5.2.1-1ubuntu0.1+esm1, 6.1.1-1, 6.2.1-2, 6.2.1-2ubuntu0.1, 6.2.1-2ubuntu0.1~esm1, 6.2.1-2ubuntu0.1~esm2, 6.2.1-2ubuntu0.2, 6.2.1-2ubuntu0.2+esm1, 6.5.2-1, 6.6.1-1, 6.6.1-1ubuntu0.2, 6.6.1-1ubuntu0.2+esm1, 7.1.1-1.1ubuntu1, 7.7.0-1, 7.7.0-2, 7.7.0-3, 7.7.3-1, 7.7.3-1build1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-40394
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:43 UTC · Revision 1
Source evidence
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
osv:UBUNTU-CVE-2026-40394
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
varnish
Fixed versions: Not specified
Complete source record
{
"id": "17f56c3cfbd5a884401d5d72f729772c544c0c26356d1d85314e076911c709ed",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-40394",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-40394",
"summary": "Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a \"workspace overflow\" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.",
"evidence": "osv:UBUNTU-CVE-2026-40394",
"products": [
{
"name": {
"value": "varnish",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "3.0.4-1ubuntu1",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.4-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.5-1ubuntu2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.5-2ubuntu0.1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.0.3-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1-1ubuntu0.2",
"evidence": "/affected/1/versions"
},
{
"value": "4.1.1-1ubuntu0.2+esm1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.0-7.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.1-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.1-1ubuntu0.1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.1-1ubuntu0.1+esm1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.1.1-1",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.1~esm1",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.1~esm2",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.1",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.2",
"evidence": "/affected/3/versions"
},
{
"value": "6.2.1-2ubuntu0.2+esm1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.5.2-1",
"evidence": "/affected/4/versions"
},
{
"value": "6.6.1-1",
"evidence": "/affected/4/versions"
},
{
"value": "6.6.1-1ubuntu0.2",
"evidence": "/affected/4/versions"
},
{
"value": "6.6.1-1ubuntu0.2+esm1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.1.1-1.1ubuntu1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.7.0-1",
"evidence": "/affected/6/versions"
},
{
"value": "7.7.0-2",
"evidence": "/affected/6/versions"
},
{
"value": "7.7.0-3",
"evidence": "/affected/6/versions"
},
{
"value": "7.7.3-1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.7.3-1build1",
"evidence": "/affected/7/versions"
}
]
},
{
"name": {
"value": "varnish",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.7.3-1",
"evidence": "/affected/8/versions"
},
{
"value": "7.7.3-1build1",
"evidence": "/affected/8/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2026-40394",
"aliases": [
"UBUNTU-CVE-2026-40394"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
},
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=trusty",
"ecosystem": "Ubuntu:14.04:LTS"
},
"versions": [
"3.0.4-1ubuntu1",
"3.0.4-1ubuntu2",
"3.0.5-1ubuntu2",
"3.0.5-2",
"3.0.5-2ubuntu0.1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi1",
"binary_version": "3.0.5-2ubuntu0.1"
},
{
"binary_name": "varnish",
"binary_version": "3.0.5-2ubuntu0.1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"4.0.3-1",
"4.1.0-1",
"4.1.0-2",
"4.1.1-1",
"4.1.1-1ubuntu0.2",
"4.1.1-1ubuntu0.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi1",
"binary_version": "4.1.1-1ubuntu0.2+esm1"
},
{
"binary_name": "varnish",
"binary_version": "4.1.1-1ubuntu0.2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"5.0.0-7.1",
"5.2.1-1",
"5.2.1-1ubuntu0.1",
"5.2.1-1ubuntu0.1+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi1",
"binary_version": "5.2.1-1ubuntu0.1+esm1"
},
{
"binary_name": "varnish",
"binary_version": "5.2.1-1ubuntu0.1+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"6.1.1-1",
"6.2.1-2",
"6.2.1-2ubuntu0.1~esm1",
"6.2.1-2ubuntu0.1~esm2",
"6.2.1-2ubuntu0.1",
"6.2.1-2ubuntu0.2",
"6.2.1-2ubuntu0.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi2",
"binary_version": "6.2.1-2ubuntu0.2+esm1"
},
{
"binary_name": "varnish",
"binary_version": "6.2.1-2ubuntu0.2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=esm-apps%2Fjammy",
"ecosystem": "Ubuntu:Pro:22.04:LTS"
},
"versions": [
"6.5.2-1",
"6.6.1-1",
"6.6.1-1ubuntu0.2",
"6.6.1-1ubuntu0.2+esm1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi2",
"binary_version": "6.6.1-1ubuntu0.2+esm1"
},
{
"binary_name": "varnish",
"binary_version": "6.6.1-1ubuntu0.2+esm1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"7.1.1-1.1ubuntu1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.1.1-1.1ubuntu1"
},
{
"binary_name": "varnish",
"binary_version": "7.1.1-1.1ubuntu1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"7.7.0-1",
"7.7.0-2",
"7.7.0-3",
"7.7.3-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.7.3-1"
},
{
"binary_name": "varnish",
"binary_version": "7.7.3-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"7.7.3-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.7.3-1build1"
},
{
"binary_name": "varnish",
"binary_version": "7.7.3-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "varnish",
"purl": "pkg:deb/ubuntu/varnish?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"7.7.3-1",
"7.7.3-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-40394.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libvarnishapi3",
"binary_version": "7.7.3-1build1"
},
{
"binary_name": "varnish",
"binary_version": "7.7.3-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:58:52.902171569Z",
"provider": "osv",
"upstream": [
"CVE-2026-40394"
],
"references": [
"https://ubuntu.com/security/CVE-2026-40394",
"https://www.cve.org/CVERecord?id=CVE-2026-40394",
"https://docs.varnish-software.com/security/VEV00002/"
]
},
"related_cves": [
{
"value": "CVE-2026-40394",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 359133,
"published_at": "2026-04-12T20:16:00+00:00"
}