Red Hat CVE-2026-40395

Varnish Enterprise is a reverse proxy and HTTP accelerator that uses VCL (Varnish Configuration Language) for request processing. The vmod_headerplus module provides the write_req0() function to update the underlying req0 object (the original read-only request from which the writable req object is derived in VCL). This capability is essential for shared VCL deployments orchestrated by Varnish Controller, where requests are refined in one VCL context before switching to another via vcl(<label>) return statements. The vulnerability stems from insufficient bounds checking when writing amended request headers back to req0's workspace allocation. When the amended req object contains more header fields than req0's workspace can accommodate, a buffer overflow occurs in the workspace memory region, triggering a daemon panic. The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), indicating the function lacks proper validation of header field count or size before attempting the write operation.