CVE-2026-40395 is a resource allocation vulnerability (CWE-770) in Varnish Enterprise prior to version 6.0.16r12. The vulnerability arises from the headerplus.write_req0() function in the vmod_headerplus module, which updates the underlying req0 object. Normally, req0 is the original read-only request from which req is derived and is both readable and writable from VCL. When an amended req contains an excessive number of header fields, this can cause a workspace overflow in req0, leading to a daemon panic and crash of the Varnish Enterprise server. This flaw can be leveraged as a denial of service attack vector by malicious clients, particularly in shared VCL environments such as those managed by the Varnish Controller.

Successful exploitation results in a denial of service condition due to a daemon panic and server crash. There is no indication of confidentiality or integrity impact. The vulnerability requires network access but has a high attack complexity, and no privileges or user interaction are needed. The CVSS score is 4.0 (medium severity). No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider limiting exposure of the vulnerable service to untrusted clients and monitor for unusual request patterns that might trigger the overflow.