Varnish Software CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM Varnish Software CVE published 2026-04-12

CVE-2026-40394

A PatchSiren debrief of CVE-2026-40394, a medium-severity vulnerability in Varnish Cache and Varnish Enterprise that allows a denial-of-service (daemon panic) via a workspace overflow when handling prefetched data during HTTP/2 upgrades. The vulnerability occurs during the upgrade from HTTP/1 to HTTP/2, where a buffer allocation is made to reserve space to send frames to the client. Depending on the amoun [truncated]