Varnish Cache CVE-2025-30346 VSV00015

MEDIUM

N/A vendor:alpine

Information Disclosure

Lifecycle Timeline

Analysis Generated

May 27, 2026 - 23:04 vuln.today

DescriptionCVE.org

Alpine Linux: varnish fixed in 7.7.0-r0

AnalysisAI

Varnish Cache received a security fix packaged as varnish 7.7.0-r0 in Alpine Linux, addressing the vulnerability tracked under Varnish Security Advisory VSV00015. The upstream fix corresponds to Varnish Cache 7.7.0 or a patched variant thereof. Due to the absence of CVSS scoring, CWE classification, and a detailed description in the provided intelligence, the specific vulnerability class, attack vector, and exploitability cannot be independently characterized - only the fix version and advisory identifier are confirmed from the available data. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.

Technical ContextAI

Varnish Cache is a widely deployed HTTP reverse proxy and caching layer commonly placed in front of web application stacks to accelerate content delivery. VSV-prefixed advisories (Varnish Security Vulnerabilities) are official disclosures published by the Varnish project maintainers. The Alpine Linux package designation 7.7.0-r0 indicates this fix was introduced in the Alpine packaging of Varnish upstream version 7.7.0. Without a CWE classification or detailed description in the provided data, the root-cause vulnerability class - whether memory corruption, request parsing flaw, access control bypass, or other - cannot be determined from this dataset alone. CPE strings were not provided, so exact affected version boundaries are inferred solely from the Alpine fix version.

Affected ProductsAI

Based on the Alpine Linux package fix, Varnish Cache versions prior to the 7.7.0 release line are affected as packaged in Alpine Linux (Alpine package varnish < 7.7.0-r0). No CPE strings were provided in the source data. Exact upstream version boundaries affecting non-Alpine distributions (e.g., Debian, RHEL, Docker images, or directly compiled Varnish deployments) are not determinable from this dataset and should be confirmed via the official Varnish Security Advisory VSV00015 at the Varnish project website.

RemediationAI

Upgrade the Alpine Linux varnish package to version 7.7.0-r0 or later using the standard Alpine package manager: 'apk upgrade varnish'. For non-Alpine deployments, consult the upstream Varnish Cache release notes for version 7.7.0 and the official VSV00015 advisory published at varnish-cache.org/security to identify the minimum patched version applicable to your distribution or build. No workarounds or compensating controls can be responsibly recommended without knowing the vulnerability type from the sparse data provided - applying the vendor patch is the only confirmed remediation action. If immediate patching is not feasible, consider restricting access to the Varnish management interface and reducing attack surface by allowing only trusted upstream traffic until the patch can be applied.