Varnish Cache 9 before 9.0.1 permits a workspace overflow that leads to a daemon panic when a client performs HTTP/1 pipelining after a timeout. The overflow occurs because the prefetched data from one request may exceed the new workspace_client size during transition, causing a panic. This results in an abrupt service shutdown, denying availability to all users. The flaw is linked to improper buffer size handling (CWE-131) and synchronization errors (CWE-670). No remote code execution is possible; the attack is limited to causing a denial of service.

The affected vendor is Varnish Software, product Varnish Cache. Versions 9.0.0 through any earlier build of 9.0.1 are vulnerable. The issue appears only in the 9.x series before the 9.0.1 release that addressed the workspace API adaptation. Systems running these versions and exposed to Internet clients that can send HTTP/1 pipelined requests are at risk.

The CVSS score of 4 denotes a medium impact on availability. EPSS reports less than 1% likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack likely originates from a remote client that can maintain a persistent connection and send a pipelined request after exploiting the timeout_linger behavior; the required conditions are publicly reachable HTTP/1 interfaces and unpatched Varnish Cache versions. Given the low exploitation probability and the nature of the attack, the overall risk is moderate, but the impact on availability can be severe for critical services.