CVE-2026-40394 affects Varnish Cache 9.0.0 and earlier versions, where the handling of HTTP/2 session upgrades involves repurposing an HTTP/1 request as stream zero and allocating buffer space to send frames to the client. This allocation splits the original workspace, and depending on the amount of prefetched data, subsequent fetch operations may perform pipelining that exceeds the workspace capacity, causing a workspace overflow and resulting in a denial of service via daemon panic. The vulnerability is categorized under CWE-670, indicating a control flow implementation flaw.

The vulnerability can cause a denial of service condition by crashing the Varnish Cache daemon due to workspace overflow during HTTP/2 session upgrades with specific prefetched data amounts. There is no impact on confidentiality or integrity, and no known exploits are reported in the wild. The CVSS score is 4.0 (medium severity), reflecting a network attack vector with high attack complexity but no privileges or user interaction required.

No official patch or remediation level has been confirmed at this time. Users should monitor the vendor advisory for updates regarding fixes. Until a patch is available, consider limiting exposure to untrusted HTTP/2 traffic or disabling HTTP/2 support if feasible to reduce risk.