{"id":"CVE-2025-30346","aliases":["ALPINE-CVE-2025-30346","BIT-varnish-2025-30346","DEBIAN-CVE-2025-30346","DLA-4101-1","DSA-5918-1","EUVD-2025-7260","GHSA-hxcm-q7m2-7qhp","OESA-2025-1333","UBUNTU-CVE-2025-30346","openSUSE-SU-2025:14992-1","openSUSE-SU-2026:10751-1","openSUSE-SU-2026:22131-1"],"status":"published","title":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via...","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00313,"percentile":0.2439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-444"],"published":"2025-03-21T00:00:00Z","modified":"2026-10-28T10:45:16Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"varnish","fixed_in":["7.6.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"varnish","fixed_in":["7.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"varnish","fixed_in":["7.7.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"varnish","fixed_in":["7.7.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"varnish","fixed_in":["7.1.1-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"varnish","fixed_in":["7.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"varnish","fixed_in":["6.5.1-1+deb11u4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","fixed_in":["7.4.3-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-2.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","fixed_in":["7.4.3-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","fixed_in":["7.4.3-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"varnish","fixed_in":["7.4.3-2.oe2403"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"varnish","fixed_in":["7.7.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"varnish","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2"]},{"source":"osv","ecosystem":"Debian:13","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.5.1-1+deb11u4"}]}],"versions":["6.5.1-1","6.5.1-1+deb11u1","6.5.1-1+deb11u2","6.5.1-1+deb11u3"]},{"source":"osv","ecosystem":"Debian:12","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.1-2+deb12u1"}]}],"versions":["7.1.1-1.1","7.1.1-1.1+deb12u1","7.1.1-1.2"],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-2.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4.3-2.oe2403"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-1ubuntu1","3.0.4-1ubuntu2","3.0.5-1ubuntu2","3.0.5-2","3.0.5-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.3-1","4.1.0-1","4.1.0-2","4.1.1-1","4.1.1-1ubuntu0.2","4.1.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-7.1","5.2.1-1","5.2.1-1ubuntu0.1","5.2.1-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.1-1","6.2.1-2","6.2.1-2ubuntu0.1~esm1","6.2.1-2ubuntu0.1~esm2","6.2.1-2ubuntu0.1","6.2.1-2ubuntu0.2","6.2.1-2ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.2-1","6.6.1-1","6.6.1-1ubuntu0.2","6.6.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.1.1-1.1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"vinyl-cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.0.0-1.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"varnish","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.7.3-bp160.1.1"}]}],"bundled":2}],"products":[{"vendor":"varnish-software","product":"varnish cache"},{"vendor":"varnish-software","product":"varnish_enterprise"},{"vendor":"varnish_cache_project","product":"varnish_cache"}],"references":[{"url":"https://varnish-cache.org/security/VSV00015.html","tags":["Vendor Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30346","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-hxcm-q7m2-7qhp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2025-30346","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30346.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-30346","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1333","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-30346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-30346","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/8ef69a03b36aeac5f364c01eb20f821860e47f14","tags":["report"]},{"url":"https://github.com/varnishcache/varnish-cache/commit/a9640a13276048815cc51a12cda2603f4d4444e4","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4W2PDV3WT6MOJEDJ7A2X2U22B5IJIJ4U/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30346","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15892","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-38150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-45060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-44487","tags":["web"]},{"url":"https://bugzilla.suse.com/1239892","tags":["report"]},{"url":"https://bugzilla.suse.com/1280114","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-8671","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T00:00:00Z","modified":"2025-04-03T13:05:21.274Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:32:35.099955Z"}],"euvd":[{"id":"EUVD-2025-7260","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T00:00:00Z","modified":"2025-04-03T13:05:21Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:44.372321Z"}],"ghsa":[{"id":"GHSA-hxcm-q7m2-7qhp","title":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via...","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T09:30:34Z","modified":"2025-04-03T00:32:35Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:00:36.60124Z"}],"nvd":[{"id":"CVE-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T07:15:37.35Z","modified":"2026-06-17T09:08:33.187Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T14:10:54.744127Z"}],"osv":[{"id":"ALPINE-CVE-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T07:15:37.35Z","modified":"2026-08-27T22:18:02.874423088Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:50.269992Z"},{"id":"CVE-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T00:00:00Z","modified":"2026-10-28T10:45:16.332171508Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-444"],"updated_at":"2026-11-02T15:44:47.708311Z"},{"id":"DEBIAN-CVE-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T07:15:37.35Z","modified":"2026-09-01T20:05:45.499554468Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-1333","title":"varnish security update","description":"This is Varnish Cache, a web application accelerator also known as a caching HTTP reverse proxy. You install it in front of any server that speaks HTTP and configure it to cache the contents. Varnish Cache is really, really fast. It typically speeds up delivery with a factor of 300 - 1000x, depending on your architecture.\r\n\r\nSecurity Fix(es):\n\nVarnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.(CVE-2025-30346)","status":"published","published":"2025-03-29T11:08:26Z","modified":"2026-08-18T01:18:50.08177828Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:42.714349Z"},{"id":"UBUNTU-CVE-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-21T07:15:00Z","modified":"2026-04-22T15:41:53.07927Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:26.330196Z"},{"id":"BIT-varnish-2025-30346","description":"Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.","status":"published","published":"2025-03-25T07:44:36.946Z","modified":"2026-09-10T16:01:48.416724806Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"DLA-4101-1","title":"varnish - security update","status":"published","published":"2025-03-31T00:00:00Z","modified":"2026-03-09T01:20:59.940425Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5918-1","title":"varnish - security update","status":"published","published":"2025-05-13T00:00:00Z","modified":"2026-03-09T02:11:32.798045Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:14992-1","title":"libvarnishapi3-7.7.0-1.1 on GA media","description":"These are all security issues fixed in the libvarnishapi3-7.7.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-14T00:00:00Z","modified":"2026-02-04T04:26:21.933462Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10751-1","title":"libvinylapi3-9.0.0-1.1 on GA media","description":"These are all security issues fixed in the libvinylapi3-9.0.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-11T00:00:00Z","modified":"2026-05-12T08:45:57.407348Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:22131-1","title":"Security update for varnish","description":"This update for varnish fixes the following issues:\n\nChanges in varnish:\n\n- update to 7.7.3 (bsc#1280114, CVE-2025-8671):\n  * https://vinyl-cache.org/docs/7.7/whats-new/changes-7.7.html\n  * https://vinyl-cache.org/security/VSV00017.html#vsv00017\n\n- Update to release 7.7.1\n  * VSV-16: Resolve request smuggling attack\n\n- Update to release 7.7.0\n  * The `linux` jail gained control of transparent huge pages\n    settings.\n  * An issue has been fixed which could cause a crash when varnishd\n    receives an invalid Content-Range header from a backend.\n  * Timestamping for HTTP/2 requests (when idle period begins) has\n    been switched to be more in line with HTTP/1.\n  * VSV-15: The client connection is now always closed when a\n    malformed request is received. [CVE-2025-30346, boo#1239892]\n","status":"published","published":"2026-10-19T17:55:58Z","modified":"2026-10-20T19:15:03.943417663Z","updated_at":"2026-11-02T16:58:42.426393Z"}]}}