CVE-2026-40396 is a medium severity vulnerability in Varnish Cache 9.0.0 where improper control flow in the pipelining implementation causes a workspace overflow. This overflow triggers a daemon panic (crash) when a client exploits timing windows between timeout_linger and timeout_idle by sending multiple HTTP/1 requests in a pipelined manner. The root cause is a missed code path during merge conflict resolution adapting Varnish Enterprise's non-blocking HTTP/2 architecture to Varnish Cache, resulting in a failure to perform a complete workspace rollback and losing the guarantee that prefetched data fits within workspace_client. This leads to a denial of service condition.

The vulnerability causes a denial of service by crashing the Varnish Cache server daemon. There is no indication of confidentiality or integrity impact. Exploitation requires network access and precise timing to trigger pipelining between requests. No known exploits are reported in the wild.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, consider restricting access to Varnish Cache 9.0.0 instances to trusted clients and monitor for unusual request patterns that may indicate attempts to exploit pipelining behavior.