Medium severity · published Mar 21, 2025
CVE-2025-30346
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VC
Varnish Cache · varnish-software
7.5.0 before 7.6.2 · source: vendor, NVD
VE
Varnish Enterprise · Varnish-software
6.0.11; 6.0.11; 6.0.11; 6.0.11; 6.0.11; 6.0.11; +19 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-30346
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-30346
Vendor Advisory
https://varnish-cache.org/security/VSV00015.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html
More from Varnish Cache
9.8
CVE-2026-34475
Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1, potentially leading to…
9.1
CVE-2022-23959
In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4,…
7.5
CVE-2026-40396
Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger
7.5
CVE-2026-40394
Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allows a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data
7.5
CVE-2025-8671
No description published yet