CVE-2025-30346

Description

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Affected packages (5)

• Alpine/varnishfrom 0, < 7.6.3-r0
• Bitnami/varnishfrom 0
• Debian/varnishfrom 0, < 6.5.1-1+deb11u4
• Debian/varnishfrom 0, < 6.5.1-1+deb11u4
• Debian/varnishfrom 0, < 7.1.1-2+deb12u1

CVSS scores

References (5)

• ADVISORYhttps://security.alpinelinux.org/vuln/CVE-2025-30346
• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2025-30346
• WEBhttps://lists.debian.org/debian-lts-announce/2025/03/msg00027.html
• WEBhttps://nvd.nist.gov/vuln/detail/CVE-2025-30346
• WEBhttps://varnish-cache.org/security/VSV00015.html