CVE-2026-40395

Estado: AnalizadaAlta (7.5)—

Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments.

Leer descripción completaMostrar menos

If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.40%
Percentil entre todas las CVEs puntuadas: 33
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access85 %
Impacto principalT1499.004 Application or System Exploitationimpact90 %

Vulnerabilidad de red sin autenticación (AV:N/PR:N) en servicio remoto. Atacante remoto causa pánico del demonio (denial of service) mediante overflow de workspace con headers excesivos en solicitud HTTP malformada.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

Varnish-software — Varnish Enterprise

CWE

CWE-770

Referencias

https://docs.varnish-software.com/security/VEV00003/

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-40395",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-40395",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-13T15:45:24.491498Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "varnish-software",
          "product": "Varnish Enterprise",
          "versions": [
            {
              "status": "affected",
              "version": "6.0.9r5",
              "lessThan": "6.0.16r12",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-12T20:16:18.893",
  "references": [
    {
      "url": "https://docs.varnish-software.com/security/VEV00003/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Varnish Enterprise before 6.0.16r12 allows a \"workspace overflow\" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients."
    }
  ],
  "lastModified": "2026-06-17T10:45:14.283",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E53A64C0-FC22-40B5-8C3B-6288B44AC3FC",
              "versionEndIncluding": "6.0.15"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F24D68B5-362E-4797-B6DE-C19A2893186C"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "910BAD01-26E5-4D12-AA23-0BD2D48F229C"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCF39307-6F25-4D97-8901-EE1A80A66AD9"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05E529DF-DEE1-4A62-998B-CA312DF888FD"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8AB27B34-2951-4755-851C-7C942DAFB6C7"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "18A22D42-B038-4E09-92DD-8AFD2F51A340"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE76D616-3AA8-4D9A-9D41-9AE35FE20DBC"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C5610CF-1FE4-4DF8-8D49-7C0CCF0359E4"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "27B776B2-9C38-45BE-89E4-ECDEEAE538A9"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED3CA600-C88D-4825-8C36-E052822AF59F"
            },
            {
              "criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.16:r9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B1D57B1-9771-4195-9EE3-B26EA776FB6B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}