CVE-2026-40395

NameCVE-2026-40395
DescriptionVarnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
varnish (PTS)bullseye6.5.1-1+deb11u3fixed
bullseye (security)6.5.1-1+deb11u5fixed
bookworm, bookworm (security)7.1.1-2+deb12u1fixed
trixie7.7.0-3fixed
forky, sid7.7.3-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
varnishsource(unstable)(not affected)

Notes

- varnish <not-affected> (Specific to Varnish Enterprise)
https://docs.varnish-software.com/security/VEV00003/

Search for package or bug name: Reporting problems