Varnish Cache EUVD-2026-21742

CVSS 4.0 with AV:N/AC:H/PR:N/UI:N/S:C/A:L indicates remote exploitation without authentication but with high attack complexity, causing partial availability loss across scope boundaries. The high attack complexity reflects the precise timing required: attacker must coordinate three events (initial request, timeout_linger expiry, pipelined request arrival) within a narrow window. EPSS data not provided, but given AC:H and limited impact (denial of service, not code execution), real-world exploitation probability is moderate. The vulnerability is not confirmed as actively exploited (no KEV status), and no public exploit code is referenced. However, this is a legitimate production risk: the attack is deterministic once timing parameters are known, requires no special privileges, and crashes production infrastructure. Organizations running Varnish 9.0.0 should prioritize patching to 9.0.1, but enterprises with mature incident response and short timeout_linger/timeout_idle windows may accept short-term risk. This is not a 'high-CVSS-but-low-risk' issue; AC:H accurately reflects real attack barriers.

A malicious client connects to a Varnish 9.0.0 instance and sends a valid HTTP/1 request, then waits for timeout_linger (typically 1 second) to expire and release the worker thread. Before timeout_idle closes the connection, the attacker sends two or more pipelined HTTP/1 requests in rapid succession. The incomplete workspace rollback fails to properly reset memory boundaries, causing prefetched data from the first request to collide with the second, exceeding workspace_client limits. Varnish detects the memory corruption and panics, crashing the daemon and denying service to all clients routed through that instance.