The vulnerability in Varnish Cache and Varnish Enterprise allows an attacker to trigger a workspace overflow that causes the daemon to panic and stop serving requests. It stems from a buffer allocation made during the HTTP/2 session upgrade, which, given certain amounts of prefetched data, can deplete available workspace and induce a denial of service. The weakness corresponds to CWE‑131 (Incorrect Calculation of Buffer Size) and CWE‑670 (Privilege Escalation). The result is loss of service for the affected instance, impacting application availability for all users of the server.

Varnish Cache 9 versions prior to 9.0.1 and Varnish Enterprise 6 versions before 6.0.16r11 are affected. The issue applies to environments running Varnish on the corresponding software releases.

The CVSS score of 4 indicates moderate severity, and the EPSS score of less than 1% suggests low probability of current exploitation. The vulnerability has not been reported in the CISA KEV catalog. The exploit requires connection to the Varnish instance, configuration of an HTTP/2 session, and delivery of prefetched data that triggers the overflow, implying a remote or network‑based attack vector.