https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-40396.htmlhttps://patchthecve.com/cve/CVE-2026-40396.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.0: Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait long enough until the session releases its worker thread (timeout_linger) and resume traffic before the session is closed (timeout_ihttps://patchthecve.com/cve/CVE-2026-40394.htmlhttps://patchthecve.com/cve/CVE-2026-40394.htmlMon, 26 Oct 2026 21:10:00 +0000MEDIUM 4.0: Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. The setup of an HTTP/2 session starts with a speculative HTTP/1 transport, and upon upgrading to h2 the HTTP/1 request is repurphttps://patchthecve.com/cve/CVE-2026-34475.htmlhttps://patchthecve.com/cve/CVE-2026-34475.htmlMon, 26 Oct 2026 22:10:00 +0000MEDIUM 5.4: Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to cache poisoning or authentication bypass.