CVE Explorer
CVE-2026-40395
Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnis
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"defaultStatus":"unaffected","product":"Varnish Enterprise","vendor":"varnish-software","versions":[{"lessThan":"6.0.16r12","status":"affected","version":"6.0.9r5","versionType":"custom"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:cd1edd6469147b2e7c4af49d767e6b47161825755268433a10a4360f5d9c8b7a · sha256:317643530e5d46b1… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L","version":"3.1"},"metric_type":"cvssV3_1"}
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:cd1edd6469147b2e7c4af49d767e6b47161825755268433a10a4360f5d9c8b7a · sha256:317643530e5d46b1… · /containers/cna/metrics/0/cvssV3_1
CWE assertions
1 source assertion{"cweId":"CWE-770","description":"CWE-770 Allocation of Resources Without Limits or Throttling","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:cd1edd6469147b2e7c4af49d767e6b47161825755268433a10a4360f5d9c8b7a · sha256:317643530e5d46b1… · /containers/cna/problemTypes/0/descriptions/0
Source references
1 source assertion{"url":"https://docs.varnish-software.com/security/VEV00003/"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:cd1edd6469147b2e7c4af49d767e6b47161825755268433a10a4360f5d9c8b7a · sha256:317643530e5d46b1… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.