CVE-2025-30346: Varnish-Software Varnish Enterprise

Medium severity, CVSS 4.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0.13r10 allow client-side desync via HTTP/1 requests.

Affected products

• Varnish-Software Varnish Enterprise: version 6.0.11 only; version 6.0.12 only; version 6.0.13 only
• Varnish Cache Project Varnish Cache: before 7.6.2 (fixed in 7.6.2)

Published 2025-03-21. Last modified 2026-06-17.