CVE-2025-30346: Medium severity Varnish Varnish Cache vulnerability
Published Mar 21, 2025
·Updated
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
Affected Software
28 affected components
Varnish Varnish Cache<7.6.2
Varnish Varnish Enterprise<6.0.13r10
Varnish-software Varnish Enterprise=6.0.11-r1
Varnish-software Varnish Enterprise=6.0.11-r2
Varnish-software Varnish Enterprise=6.0.11-r3
Varnish-software Varnish Enterprise=6.0.11-r4
Varnish-software Varnish Enterprise=6.0.11-r5
Varnish-software Varnish Enterprise=6.0.11-r6
Varnish-software Varnish Enterprise=6.0.11-r7
Varnish-software Varnish Enterprise=6.0.12-r1
Varnish-software Varnish Enterprise=6.0.12-r2
Varnish-software Varnish Enterprise=6.0.12-r3
Varnish-software Varnish Enterprise=6.0.12-r4
Varnish-software Varnish Enterprise=6.0.12-r5
Varnish-software Varnish Enterprise=6.0.12-r6
Varnish-software Varnish Enterprise=6.0.12-r7
Varnish-software Varnish Enterprise=6.0.12-r8
Varnish-software Varnish Enterprise=6.0.12-r9
Varnish-software Varnish Enterprise=6.0.13-r1
Varnish-software Varnish Enterprise=6.0.13-r2
Varnish-software Varnish Enterprise=6.0.13-r3
Varnish-software Varnish Enterprise=6.0.13-r4
Varnish-software Varnish Enterprise=6.0.13-r5
Varnish-software Varnish Enterprise=6.0.13-r6
Varnish-software Varnish Enterprise=6.0.13-r7
Varnish-software Varnish Enterprise=6.0.13-r8
Varnish-software Varnish Enterprise=6.0.13-r9
Varnish Cache Project Varnish Cache<7.6.2
Event History
Mar 21, 2025
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Sep 17, 57206
Event
via FIRST·02:56 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-30346?
The severity of CVE-2025-30346 is classified as high due to the potential for client-side desynchronization exploits.
2
How do I fix CVE-2025-30346?
To mitigate CVE-2025-30346, upgrade Varnish Cache to version 7.6.2 or later and Varnish Enterprise to version 6.0.13r10 or later.
3
What types of software are affected by CVE-2025-30346?
CVE-2025-30346 affects Varnish Cache versions prior to 7.6.2 and Varnish Enterprise versions prior to 6.0.13r10.
4
What kind of exploitation does CVE-2025-30346 allow?
CVE-2025-30346 allows for client-side desynchronization via specially crafted HTTP/1 requests.
5
Is CVE-2025-30346 a remote vulnerability?
Yes, CVE-2025-30346 can potentially be exploited remotely, making it a significant security concern.