CVE-2025-30346 Other in Varnish Cache
Attackers can exploit HTTP/1 request desync in Varnish Cache to bypass security controls or poison caches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30346?
CVE-2025-30346 is a medium-severity vulnerability in varnish-software Varnish Cache, published on 21 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
Weakness: CWE-444
Which versions are affected by CVE-2025-30346?
1 open source package ship an affected version, including varnish. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
varnish Bitnami | All versions | None |
Linux distribution packages (1)
varnish openSUSE:Tumbleweed | All versions | 7.7.0-1.1 |
Products include Varnish-Software Varnish Enterprise, Varnish Cache Project Varnish Cache.
How do I fix CVE-2025-30346?
Upgrade to a fixed version.
Is CVE-2025-30346 being exploited?
There is no known exploitation of CVE-2025-30346 in the wild and no public exploit code.
Other vulnerabilities in varnish-software Varnish Cache
- CVE-2023-41104 Memory corruption in n/a
- CVE-2026-34475 Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of /
- CVE-2026-40394 Denial of service in Varnish Cache
- CVE-2026-40395 Denial of service in Varnish Enterprise
- CVE-2025-30347 Information disclosure in Varnish Enterprise
Sources
Also known as ALPINE-CVE-2025-30346, BIT-varnish-2025-30346, DEBIAN-CVE-2025-30346, DLA-4101-1, GHSA-hxcm-q7m2-7qhp, OESA-2025-1333 and 2 more.