CVE-2025-30346 | ByteOS Network

Vulnerability Details :

CVE-2025-30346

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-21 Mar, 2025 | 00:00

Updated At-03 Apr, 2025 | 13:05

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:21 Mar, 2025 | 00:00

Updated At:03 Apr, 2025 | 13:05

▼CVE Numbering Authority (CNA)

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Affected Products

Vendor

varnish-software

Product

Default Status

unknown

Versions

Affected

From 7.5.0 before 7.6.2 (semver)

Problem Types

Type	CWE ID	Description
CWE	CWE-444	CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Type: CWE

CWE ID: CWE-444

Description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Metrics

Version	Base score	Base severity	Vector
3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

Hyperlink	Resource
https://varnish-cache.org/security/VSV00015.html	N/A

Hyperlink: https://varnish-cache.org/security/VSV00015.html

Resource: N/A

▼Authorized Data Publishers (ADP)

1. CVE Program Container

References

Hyperlink	Resource
https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html	N/A

Hyperlink: https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html

Resource: N/A

2. CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:21 Mar, 2025 | 07:15

Updated At:02 Apr, 2025 | 22:15

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	5.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary	3.1	4.8	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Type: Secondary

Version: 3.1

Base score: 5.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Type: Primary

Version: 3.1

Base score: 4.8

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CPE Matches

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r1:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r2:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r3:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r4:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r5:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r6:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.11

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.11:r7:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r1:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r2:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r3:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r4:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r5:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r6:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r7:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r8:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.12

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.12:r9:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r1:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r2:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r3:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r4:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r5:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r6:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r7:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r8:*:*:*:*:*:*

varnish-software>>varnish_enterprise>>6.0.13

cpe:2.3:a:varnish-software:varnish_enterprise:6.0.13:r9:*:*:*:*:*:*

varnish_cache_project>>varnish_cache>>Versions before 7.6.2(exclusive)

cpe:2.3:a:varnish_cache_project:varnish_cache:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-444	Secondary	cve@mitre.org
CWE-444	Primary	nvd@nist.gov

CWE ID: CWE-444

Type: Secondary

Source: cve@mitre.org

CWE ID: CWE-444

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://varnish-cache.org/security/VSV00015.html	cve@mitre.org	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: https://varnish-cache.org/security/VSV00015.html

Source: cve@mitre.org

Resource:

Vendor Advisory

Hyperlink: https://lists.debian.org/debian-lts-announce/2025/03/msg00027.html

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A