CVE-2026-40394 is a vulnerability in Varnish Cache 9.0.0 and earlier versions of Varnish Enterprise that leads to a workspace overflow denial of service. The problem arises during the HTTP/2 session upgrade, which initially starts as a speculative HTTP/1 transport. When upgrading to HTTP/2, the HTTP/1 request is repurposed as stream zero, and a buffer allocation is made to reserve space for sending frames to the client. This allocation splits the original workspace, and depending on the amount of prefetched data, subsequent fetch operations may run out of workspace, causing a daemon panic and service disruption. The vulnerability is classified under CWE-670 (Always-Incorrect Control Flow Implementation).

The vulnerability can cause a denial of service by crashing the Varnish Cache daemon due to workspace overflow during HTTP/2 session upgrades. This results in service disruption but does not impact confidentiality or integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or temporary fix is indicated, users should monitor vendor communications for updates. Until a fix is available, consider limiting or controlling HTTP/2 traffic or prefetched data amounts if feasible to reduce exposure.