CVE-2025-30346

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2025-30346", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2025-04-03T13:05:21.274Z", "dateReserved": "2025-03-21T00:00:00.000Z", "datePublished": "2025-03-21T00:00:00.000Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Varnish Cache", "vendor": "varnish-software", "versions": [{"lessThan": "7.6.2", "status": "affected", "version": "7.5.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "value": "Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-03-21T06:36:41.957Z"}, "references": [{"url": "https://varnish-cache.org/security/VSV00015.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.5.0", "versionEndExcluding": "7.6.2"}]}]}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-04-02T22:03:26.875Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-21T14:00:05.673568Z", "id": "CVE-2025-30346", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-03T13:05:21.274Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-04-02T22:03:26.875Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-30346", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-21T14:00:05.673568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T14:00:27.920Z"}}], "cna": {"metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "varnish-software", "product": "Varnish Cache", "versions": [{"status": "affected", "version": "7.5.0", "lessThan": "7.6.2", "versionType": "semver"}], "defaultStatus": "unknown"}], "references": [{"url": "https://varnish-cache.org/security/VSV00015.html"}], "x_generator": {"engine": "enrichogram 0.0.1"}, "descriptions": [{"lang": "en", "value": "Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-444", "description": "CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:varnish-software:varnish_cache:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.6.2", "versionStartIncluding": "7.5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-03-21T06:36:41.957Z"}}}, "cveMetadata": {"cveId": "CVE-2025-30346", "state": "PUBLISHED", "dateUpdated": "2025-04-03T13:05:21.274Z", "dateReserved": "2025-03-21T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-03-21T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "Varnish Cache", "vendor": "varnish-software", "versions": [{"lessThan": "7.6.2", "status": "affected", "version": "7.5.0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r1:*:*:*:*:*:*", "matchCriteriaId": "943E3FE8-EA6D-4500-8014-697A9A0CEF91", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r2:*:*:*:*:*:*", "matchCriteriaId": "F2CBF396-441D-44F2-BAFF-D3B2A981FBCD", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r3:*:*:*:*:*:*", "matchCriteriaId": "136343D5-80C1-4F83-8471-2C26F9FD492A", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r4:*:*:*:*:*:*", "matchCriteriaId": "A34B5F57-B86F-41CB-A3D8-9084960D3E45", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r5:*:*:*:*:*:*", "matchCriteriaId": "F56C6B72-1648-4BC7-A1E6-909DD51DAA30", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r6:*:*:*:*:*:*", "matchCriteriaId": "F6A98E3A-74A4-46AB-BE58-EA0BF9D5EF89", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r7:*:*:*:*:*:*", "matchCriteriaId": "27571EA4-E959-4B6B-A7BA-ED18C42D59B8", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r1:*:*:*:*:*:*", "matchCriteriaId": "D94DA623-9D4C-4E20-9187-084B1F26115F", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r2:*:*:*:*:*:*", "matchCriteriaId": "EA7B6AAB-DB21-42EA-B363-C17290E0A05E", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r3:*:*:*:*:*:*", "matchCriteriaId": "7E00CC49-4237-44EC-8CE5-695F99222B91", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r4:*:*:*:*:*:*", "matchCriteriaId": "6C052A78-5D8B-4249-B298-E1AEA6A80B5C", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r5:*:*:*:*:*:*", "matchCriteriaId": "233436C7-4DE1-4780-A074-B83864B023CF", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r6:*:*:*:*:*:*", "matchCriteriaId": "2D5CE182-CC6C-4D6C-A481-D467C09756B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r7:*:*:*:*:*:*", "matchCriteriaId": "EFDE0DA4-9EDE-4EB9-870E-8402DD590566", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r8:*:*:*:*:*:*", "matchCriteriaId": "092A6346-A101-44D8-A5B2-8178B251CB6E", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r9:*:*:*:*:*:*", "matchCriteriaId": "8A5DAC70-FD7A-4E8A-B5E3-5380CDE0A7F0", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r1:*:*:*:*:*:*", "matchCriteriaId": "7345B2F1-A33C-430E-9DB9-52BF63F750A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r2:*:*:*:*:*:*", "matchCriteriaId": "5C977CB4-E9E8-49B4-9D2A-B5DFA088EA1A", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r3:*:*:*:*:*:*", "matchCriteriaId": "F0FEF673-0DED-4646-B5C2-3D5A4617380F", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r4:*:*:*:*:*:*", "matchCriteriaId": "E2128880-BA15-414B-84F0-E57B96DF376C", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r5:*:*:*:*:*:*", "matchCriteriaId": "A9C9D8DF-86F8-4020-AC66-EF8367A11EDC", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r6:*:*:*:*:*:*", "matchCriteriaId": "132F60B2-FADA-479E-B45E-166046A2567C", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r7:*:*:*:*:*:*", "matchCriteriaId": "E4FB05CB-0966-43CD-84AA-B4F2DA181446", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r8:*:*:*:*:*:*", "matchCriteriaId": "2AAA8F5B-F974-4493-9573-F60CC9E084A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r9:*:*:*:*:*:*", "matchCriteriaId": "B67CD7FB-4810-4AFA-BD4D-F2AB2A41D0A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*", "matchCriteriaId": "757060EC-9D22-4B11-9112-648A9B8A22F2", "versionEndExcluding": "7.6.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests."}, {"lang": "es", "value": "Varnish Cache anterior a 7.6.2 y Varnish Enterprise anterior a 6.0.13r10 permiten la desincronizaci\u00f3n del lado del cliente a trav\u00e9s de solicitudes HTTP/1."}], "id": "CVE-2025-30346", "lastModified": "2026-06-17T09:08:33.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.7, "source": "cve@mitre.org", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30346", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-03-21T14:00:05.673568Z", "version": "2.0.3"}}]}, "published": "2025-03-21T07:15:37.350", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://varnish-cache.org/security/VSV00015.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-444"}], "source": "cve@mitre.org", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-444"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "varnish: Client-Side Desynchronization in Varnish Cache", "id": "2354008", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2354008"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-444", "details": ["Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.", "A flaw was found in Varnish Cache and Varnish Enterprise. This vulnerability allows client-side desynchronization via crafted HTTP/1 requests."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-30346", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "varnish", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "varnish:6/varnish", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "varnish", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-30346\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-30346\nhttps://varnish-cache.org/security/VSV00015.html"], "threat_severity": "Moderate"}

{}