CVE-2026-40394
Varnish-Software Varnish Enterprise ≤ 6.0.15
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:LSummary
CVE-2026-40394 is a medium-severity Always-Incorrect Control Flow Implementation (CWE-670) vulnerability in Varnish-Software Varnish Enterprise. Its CVSS base score is 4.0 (Medium).
Operationally, ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-40394, published on 2026-04-12, is a workspace overflow vulnerability affecting Varnish Cache versions 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11. The flaw enables a denial of service (daemon panic) when processing certain amounts of prefetched data during HTTP/2 session upgrades. Specifically, an HTTP/2 session begins with a speculative HTTP/1 transport, which is repurposed as stream zero upon upgrade. This triggers a buffer allocation to reserve space for client frames, splitting the original workspace and potentially causing subsequent pipelining fetches to exhaust available workspace.
Unauthenticated remote attackers with network access (AV:N) can exploit this vulnerability, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Exploitation leads to a low-impact availability disruption (A:L) via daemon panic, with no confidentiality or integrity effects (C:N/I:N), but a changed scope (S:C), resulting in a CVSS v3.1 base score of 4.0. The issue stems from CWE-670 (Always-Incorrect Control Flow Implementation).
The Varnish Software security advisory (https://docs.varnish-software.com/security/VEV00002/) addresses this vulnerability, recommending upgrades to Varnish Cache 9.0.1 or Varnish Enterprise 6.0.16r11 as the primary mitigation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21738
Vulnerability Data
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading…
more
to h2 the HTTP/1 request is repurposed as stream zero. During the upgrade, a buffer allocation is made to reserve space to send frames to the client. This allocation would split the original workspace, and depending on the amount of prefetched data, the next fetch could perform a pipelining operation that would run out of workspace.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V9.2.1
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation at post-design stages directly exercises control-flow paths and reveals mismatches between implemented and intended behavior.
Requiring a documented development process and supporting tools reduces the chance that incorrect control-flow logic is introduced in the first place.
Flaw identification and remediation processes can locate and correct control-flow errors once they manifest as incorrect runtime behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent incorrect control-flow implementations via reviews, testing, and static analysis.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect paths that deviate from intended logic.
Secure development lifecycle processes can catch incorrect control-flow logic during design and code review.
Secure coding standards and reviews directly target flawed control-flow implementations.
Change-management gates may prevent deployment of flawed logic but do not address the coding defect itself.