dbcve.org
Varnish EnterpriseApplication · Varnish Software

CVE-2026-40395

HIGH · 7.5 CVSS v3.1 Published 2026-04-12
Fix available
A fix is available. Upgrade to after 6.0.15 or later.
See remediation →
84/100
Remediation priority · High
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates the underlying req0, which is normally the original read-only request from which req is derived (readable and writable from VCL). This is useful in the active VCL, after amending req, to prepare a refined req0 before switching to a different VCL with the return (vcl(<label>)) action. This is for example how the Varnish Controller operates shared VCL deployments. If the amended req contained too many header fields for req0, this would have resulted in a workspace overflow that would in turn trigger a panic and crash the Varnish Enterprise server. This could be used as a Denial of Service attack vector by malicious clients.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

Varnish Enterprise before 6.0.16r12 contains a workspace overflow vulnerability in the headerplus.write_req0() function from vmod_headerplus. When this function is used to update req0 (the original read-only request) with header fields from an amended req, if too many headers are present, it causes a workspace overflow that triggers a daemon panic and crashes the server. This can be exploited by malicious clients sending requests with excessive headers.

MitigationUpgrade to Varnish Enterprise 6.0.16r12 or later. If immediate upgrade is not feasible, implement request size/rate limiting at a upstream proxy or load balancer to restrict the number of headers clients can send.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Varnish EnterpriseApplication
Affected:<= 6.0.15= 6.0.16

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify Varnish Enterprise version
    Run 'varnishd -V' or check the installed package version to determine if it is 6.0.15 or earlier, or exactly 6.0.16
    Affected if The installed version is 6.0.15 or earlier, or exactly 6.0.16 (not 6.0.16r12 or later)
  2. Verify vmod_headerplus module is loaded
    Inspect VCL configuration files for 'import headerplus;' statements that load the vmod_headerplus module
    Affected if The vmod_headerplus module is loaded in the active VCL configuration
  3. Identify use of write_req0() function
    Search VCL configuration files for calls to headerplus.write_req0() function, which updates req0 with header fields from an amended request
    Affected if The write_req0() function from vmod_headerplus is being invoked in VCL

The environment is affected if Varnish Enterprise version is 6.0.16 or earlier, the vmod_headerplus module is loaded, and write_req0() function is being used in the VCL configuration.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to a release after 6.0.15
Interim mitigation

Upgrade to Varnish Enterprise 6.0.16r12 or later. If immediate upgrade is not feasible, implement request size/rate limiting at a upstream proxy or load balancer to restrict the number of headers clients can send.

Recommended fix High confidence

Varnish Enterprise 6.0.16r12 or later

  1. 1. Identify the current Varnish Enterprise version by running: varnishd -V
  2. 2. Plan an upgrade to Varnish Enterprise version 6.0.16r12 or later, which contains the fix for the workspace overflow vulnerability
  3. 3. Before upgrading, review the vmod_headerplus configuration in your VCL to identify any use of headerplus.write_req0() that could generate excessive header fields
  4. 4. Perform the upgrade following standard Varnish Enterprise upgrade procedures
  5. 5. After upgrade, verify the Varnish daemon is running correctly: varnishd -f /etc/varnish/default.vcl
  6. 6. Monitor logs to confirm the server is handling requests without panics
Caveat Review vmod_headerplus configuration before upgrading to ensure any headerplus.write_req0() usage does not generate excessive headers that could cause workspace issues

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Varnish Enterprise Scoped from the published advisory
  • Consultation2.0 h
  • Implementation2.0 h
  • Testing2.0 h
  • Review / QA2.0 h
8.0 hours of engineering $1,420
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,272.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-40395 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-40395 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data