CVE-2026-40395

VULNERABILITY OVERVIEW CVE-2026-40395 is a denial of service vulnerability affecting Varnish Enterprise versions prior to 6.0.16r12. The flaw exists in the headerplus.write_req0() function within vmod_headerplus, which fails to properly validate workspace boundaries when updating the underlying request object (req0) during shared VCL deployments. Malicious clients can exploit this by crafting requests with excessive header fields, triggering a workspace overflow that causes the Varnish daemon to panic and crash. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction. The attack is trivial to execute due to low complexity, making it highly accessible to threat actors. While the impact is limited to availability (denial of service), the consequence is severe: complete server crash and service disruption. The FAUCET Risk Score of 48.0/100 indicates moderate organizational risk when considering broader threat context. EXPLOITATION STATUS The vulnerability is currently listed on the CISA KEV Catalog as Active, indicating active exploitation has been observed in the wild. However, EPSS scoring remains relatively low at 0.00055, suggesting limited prevalence in the broader threat landscape at this time. Organizations running Varnish Enterprise in production, particularly those utilizing shared VCL deployments through Varnish Controller, should prioritize immediate patching to 6.0.16r12 or later to mitigate active attack risk.