Every CVE Search/ Get API key

CVE-2025-30346

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via...

5.4 MediumFix available

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.31%Up 0.3 points since Mar 21, 2025
90%50%10%1%

What each source reports

CVE List Score used 5.4

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
CVE-2025-30346
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
EUVDEUVD-2025-7260 5.4

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
EUVD-2025-7260
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-hxcm-q7m2-7qhp 5.4

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via...

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
GHSA-hxcm-q7m2-7qhp
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
NVD 5.4

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
CVE-2025-30346
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
OSVALPINE-CVE-2025-30346 4.8

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
ALPINE-CVE-2025-30346
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSV 5.4

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
CVE-2025-30346
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness
CWE-444
Updated
2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2025-30346 4.8

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
DEBIAN-CVE-2025-30346
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVOESA-2025-1333 4.8

varnish security update

This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.

Security Fix(es):

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.(CVE-2025-30346)

Record
OESA-2025-1333
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2025-30346 5.4

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
UBUNTU-CVE-2025-30346
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS 3.1
4.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVBIT-varnish-2025-30346 No score

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Record
BIT-varnish-2025-30346
Updated
2026-11-02
OSVopenSUSE-SU-2025:14992-1 No score

libvarnishapi3-7.7.0-1.1 on GA media

These are all security issues fixed in the libvarnishapi3-7.7.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14992-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:10751-1 No score

libvinylapi3-9.0.0-1.1 on GA media

These are all security issues fixed in the libvinylapi3-9.0.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10751-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22131-1 No score

Security update for varnish

This update for varnish fixes the following issues:

Changes in varnish:

  • update to 7.7.3 (bsc#1280114, CVE-2025-8671):

  • Update to release 7.7.1

    • VSV-16: Resolve request smuggling attack

  • Update to release 7.7.0

    • The linux jail gained control of transparent huge pages settings.
    • An issue has been fixed which could cause a crash when varnishd receives an invalid Content-Range header from a backend.
    • Timestamping for HTTP/2 requests (when idle period begins) has been switched to be more in line with HTTP/1.
    • VSV-15: The client connection is now always closed when a malformed request is received. [CVE-2025-30346, boo#1239892]
Record
openSUSE-SU-2026:22131-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
varnish
Alpine:v3.21
 before 7.6.3-r0
7.6.3-r0
varnish
Alpine:v3.22
 before 7.7.0-r0
7.7.0-r0
varnish
Alpine:v3.23
 before 7.7.0-r0
7.7.0-r0
varnish
Alpine:v3.24
 before 7.7.0-r0
7.7.0-r0
varnish
Bitnami
 All versions None known
varnish
Debian:12
 before 7.1.1-2+deb12u1, plus listed versions
7.1.1-1.17.1.1-1.1+deb12u17.1.1-1.2
7.1.1-2+deb12u1
varnish
Debian:13
 before 7.7.0-1
7.7.0-1
varnish
Debian:11
 before 6.5.1-1+deb11u4, plus listed versions
6.5.1-16.5.1-1+deb11u16.5.1-1+deb11u26.5.1-1+deb11u3
6.5.1-1+deb11u4
varnish
Debian:12
From an advisory covering 2 CVEs
 before 7.1.1-2+deb12u1, plus listed versions
7.1.1-1.17.1.1-1.1+deb12u17.1.1-1.2
7.1.1-2+deb12u1
varnish
openEuler:24.03-LTS-SP1
 before 7.4.3-2.oe2403sp1
7.4.3-2.oe2403sp1
Show 13 moreShow less
Affected packages
PackageAffectedFixed
varnish
openEuler:20.03-LTS-SP4
 before 7.4.3-2.oe2003sp4
7.4.3-2.oe2003sp4
varnish
openEuler:22.03-LTS-SP3
 before 7.4.3-2.oe2203sp3
7.4.3-2.oe2203sp3
varnish
openEuler:22.03-LTS-SP4
 before 7.4.3-2.oe2203sp4
7.4.3-2.oe2203sp4
varnish
openEuler:24.03-LTS
 before 7.4.3-2.oe2403
7.4.3-2.oe2403
varnish
Ubuntu:14.04:LTS
 All versions, plus listed versions
3.0.4-1ubuntu13.0.4-1ubuntu23.0.5-1ubuntu23.0.5-23.0.5-2ubuntu0.1
 None known
varnish
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
4.0.3-14.1.0-14.1.0-24.1.1-14.1.1-1ubuntu0.24.1.1-1ubuntu0.2+esm1
 None known
varnish
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
5.0.0-7.15.2.1-15.2.1-1ubuntu0.15.2.1-1ubuntu0.1+esm1
 None known
varnish
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
6.1.1-16.2.1-26.2.1-2ubuntu0.1~esm16.2.1-2ubuntu0.1~esm26.2.1-2ubuntu0.16.2.1-2ubuntu0.26.2.1-2ubuntu0.2+esm1
 None known
varnish
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
6.5.2-16.6.1-16.6.1-1ubuntu0.26.6.1-1ubuntu0.2+esm1
 None known
varnish
Ubuntu:24.04:LTS
 All versions, plus listed versions
7.1.1-1.1ubuntu1
 None known
varnish
openSUSE:Tumbleweed
 before 7.7.0-1.1
7.7.0-1.1
vinyl-cache
openSUSE:Tumbleweed
From an advisory covering 8 CVEs
 before 9.0.0-1.1
9.0.0-1.1
varnish
openSUSE:Leap 16.0
From an advisory covering 2 CVEs
 before 7.7.3-bp160.1.1
7.7.3-bp160.1.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-30346 is a medium vulnerability (CVSS 5.4) in Varnish-software Varnish Cache, published March 21, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in varnish 7.6.3-r0.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open