Varnish Cache CVE-2026-40394

The CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C) indicates network-based, unauthenticated attack with high complexity, affecting services across scope boundaries with only availability impact (daemon panic). EPSS of 4.0 reflects legitimate but bounded risk: attack vector is network-accessible (AV:N) and requires no privileges, but attack complexity is high (AC:H), requiring precise crafting of prefetch data amounts to trigger workspace exhaustion. The absence of public exploit code or CISA KEV confirmation suggests this remains theoretical or internally-managed by vendors. Real-world risk depends on whether attackers can reliably determine 'certain amounts of prefetched data' needed; if such tuning is difficult, practical exploitability remains low despite network accessibility. The scope change (S:C) indicates impact may extend beyond the vulnerable component, making this a moderate concern for CDN operators and reverse proxy deployments where Varnish absorbs traffic.

An unauthenticated remote attacker sends a series of HTTP requests designed to trigger HTTP/1 to HTTP/2 upgrade with carefully calibrated prefetched data payloads. By timing and sizing the prefetch amounts to fragment the Varnish workspace and force subsequent pipelined fetch operations into workspace exhaustion, the attacker causes the daemon to panic and crash, temporarily disabling the reverse proxy and degrading service availability. The high attack complexity reflects the difficulty in determining exact payload sizes without intimate knowledge of workspace allocation internals.