CVE-2025-30346
Fixed in a distro release EPSS <1%CVSS 5.4
Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.
Products: varnish-software varnish_cache
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.21 | varnish | 7.6.3-r0 |
| Alpine 3.22 | varnish | 7.7.0-r0 |
| Alpine 3.23 | varnish | 7.7.0-r0 |
| Alpine 3.24 | varnish | 7.7.0-r0 |
| Debian 11 | varnish | 6.5.1-1+deb11u4 |
| Debian 12 | varnish | 7.1.1-2+deb12u1 |
| Debian 13 | varnish | 7.7.0-1 |
| Ubuntu 14.04 LTS | varnish | no fix |
| Ubuntu 24.04 LTS | varnish | no fix |
| Ubuntu Pro 16.04 LTS | varnish | no fix |
| Ubuntu Pro 18.04 LTS | varnish | no fix |
| Ubuntu Pro 20.04 LTS | varnish | no fix |
| Ubuntu Pro 22.04 LTS | varnish | no fix |
| openSUSE Leap 16.0 | varnish | 7.7.3-bp160.1.1 |
| openSUSE Tumbleweed | varnish | 7.7.0-1.1 |
| openSUSE Tumbleweed | vinyl-cache | 9.0.0-1.1 |