Varnish Enterprise CVE-2026-40395

The CVSS v3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L) indicates a network-accessible vulnerability requiring high attack complexity that affects availability across scope boundaries (causing daemon-wide impact from a request-level issue). The high attack complexity suggests an attacker must craft requests with a specific structure-excessive headers in the amended req-and this attack only succeeds when headerplus.write_req0() is actively used in the VCL configuration, limiting the practical attack surface. The low availability impact (A:L) reflects that this is a denial of service via crash, not data destruction. The lack of confirmed active exploitation (KEV status not indicated as active, no POC reported) and the requirement for VCL configuration that explicitly calls write_req0() reduce real-world priority for organizations not using Varnish Controller or headerplus module. However, for shared VCL deployments, this represents a straightforward, repeatable DoS vector that bypasses authentication (PR:N = no privileges required) and thus merits timely patching despite the moderate CVSS score. The SSVC decision framework would classify this as: Exploitation=Unkown (no POC/KEV), Automatable=Yes (header-based attack requires no user interaction), Technical Impact=Total (daemon crash), pushing toward at least coordinated patching rather than differed remediation.

A malicious client sends a series of HTTP requests with a large number of header fields (e.g., hundreds of custom headers or duplicated standard headers) to a Varnish Enterprise instance running shared VCL with the Varnish Controller and vmod_headerplus module active. When the VCL processes the request via write_req0(), the function attempts to write the amended request object-now containing excessive headers-back to the read-only req0 workspace. The workspace allocation is insufficient to hold the expanded header set, triggering a buffer overflow and immediate daemon panic. The Varnish server crashes, causing a complete denial of service until manual restart.