There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/security/cve/CVE-2025-47711 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2365687 | Issue Tracking |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
26 Aug 2025, 16:26
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:redhat:enterprise_linux_advanced_virtualization:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:a:nbdkit_project:nbdkit:-:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* |
|
| Summary |
|
|
| References | () https://access.redhat.com/security/cve/CVE-2025-47711 - Vendor Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2365687 - Issue Tracking | |
| First Time |
Redhat enterprise Linux Advanced Virtualization
Redhat Nbdkit Project nbdkit Nbdkit Project Redhat enterprise Linux |
09 Jun 2025, 06:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-09 06:15
Updated : 2025-08-26 16:26
NVD link : CVE-2025-47711
Mitre link : CVE-2025-47711
CVE.ORG link : CVE-2025-47711
JSON object : View
Products Affected
redhat
- enterprise_linux_advanced_virtualization
- enterprise_linux
nbdkit_project
- nbdkit
CWE
CWE-193
Off-by-one Error