EUVD-2026-21742Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionCVE.org
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_idle) sending more than one request at once to trigger a pipelining operation between requests. This vulnerability affecting Varnish Cache 9.0.0 emerged from a port of the Varnish Enterprise non-blocking architecture for HTTP/2. New code was needed to adapt to a more recent workspace API that formalizes the pipelining operation. In addition to the workspace change on the Varnish Cache side, other differences created merge conflicts, like partial support for trailers in Varnish Enterprise. The conflict resolution missed one code path configuring pipelining to perform a complete workspace rollback, losing the guarantee that prefetched data would fit inside workspace_client during the transition from one request to the next. This can result in a workspace overflow, triggering a panic and crashing the Varnish server.
AnalysisAI
Varnish Cache 9.0.0 crashes (denial of service) when a remote client exploits timing between timeout_linger and timeout_idle to trigger HTTP/1 request pipelining that causes a workspace overflow in the refactored HTTP/2 architecture. The vulnerability stems from incomplete code path handling during workspace rollback in the recent non-blocking port, allowing prefetched data to exceed workspace_client boundaries and panic the daemon. Vendor-released patch: version 9.0.1. No public exploit code identified at time of analysis, but the attack requires only network access and careful timing, making real-world exploitation feasible for sophisticated attackers.
Technical ContextAI
Varnish Cache is a high-performance HTTP reverse proxy and caching engine. The vulnerability roots in CWE-670 (Always-Incorrect Control Flow Implementation) within the workspace memory management subsystem introduced during Varnish 9.0.0's port of Varnish Enterprise's non-blocking HTTP/2 architecture to the open-source codebase. The workspace API formalizes request pipelining operations and enforces memory boundaries via workspace_client limits. The bug manifests in a code path that performs incomplete workspace rollback during the transition between pipelined requests, violating the invariant that prefetched data must fit within workspace_client. When a malicious client sends an HTTP/1 request, waits for timeout_linger to release the worker thread, then resumes with multiple pipelined requests before timeout_idle closes the session, the incomplete rollback fails to reclaim workspace space, triggering heap or stack corruption detected by Varnish's panic handler.
RemediationAI
Upgrade Varnish Cache to version 9.0.1 or later immediately. Vendor-released patch: version 9.0.1. For organizations unable to patch immediately, consider temporary mitigation: reduce timeout_linger to near-zero values to eliminate the timing window between worker thread release and session closure, reducing pipelining opportunities; however, this may impact performance for legitimate keep-alive clients. Alternatively, implement network-level request pipelining detection or rate-limiting at reverse proxy or load balancer level to constrain the attack surface. Refer to the official Varnish advisory at https://github.com/varnish/varnish/releases/tag/varnish-9.0.1 and monitor https://github.com/varnish/varnish/issues/15 for additional context.
More in Varnish Cache
View allDenial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
vbf_stp_error in bin/varnishd/cache/cache_fetch.c in Varnish HTTP Cache 4.1.x before 4.1.9 and 5.x before 5.2.1 allows r
Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching out
Varnish 3.x before 3.0.7, when used in certain stacked installations, allows remote attackers to inject arbitrary HTTP h
An issue was discovered in Varnish HTTP Cache 4.0.1 through 4.0.4, 4.1.0 through 4.1.7, 5.0.0, and 5.1.0 through 5.1.2.
An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x bef
An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. Rated high severity (CVSS 7.5), this v
In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically
Varnish varnish-modules before 0.17.1 allows remote attackers to cause a denial of service (daemon restart) in some conf
An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6.2.x before 6.2.3, and 6.3.x before 6.3.2. Rated h
An issue was discovered in Varnish Cache before 6.0.4 LTS, and 6.1.x and 6.2.x before 6.2.1. Rated high severity (CVSS 7
Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length hea
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today