Off-by-one in nbdkit - CVE-2025-47711

Vulnerability identifier: #VU112886

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-47711

CWE-ID: CWE-193

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to an off-by-one error handling responses from its plugins regarding the status of data blocks. A remote client can request for a very large data range to trigger an off-by-one error and crash the server. 

nbdkit
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Fedora
nbdkit-ocaml-plugin
nbdkit-vddk-plugin
nbdkit-help
nbdkit-bash-completion
nbdkit-server
nbdkit-python3-plugin
nbdkit-plugins
nbdkit-perl-plugin
nbdkit-ocaml-plugin-devel
nbdkit-libvirt-plugin
nbdkit-guestfs-plugin
nbdkit-devel
nbdkit-debugsource
nbdkit-debuginfo
nbdkit-basic-plugins
nbdkit-basic-filters
nbdkit
nbdkit-server-debuginfo
nbdkit-xz-filter-debuginfo
nbdkit-tar-filter-debuginfo
nbdkit-gzip-filter-debuginfo
nbdkit-nbd-plugin-debuginfo
nbdkit-curl-plugin-debuginfo
nbdkit-nbd-plugin
nbdkit-basic-plugins-debuginfo
nbdkit-ssh-plugin
nbdkit-gzip-filter
nbdkit-linuxdisk-plugin
nbdkit-linuxdisk-plugin-debuginfo
nbdkit-python-plugin-debuginfo
nbdkit-tmpdisk-plugin
nbdkit-basic-filters-debuginfo
nbdkit-curl-plugin
nbdkit-tar-filter
nbdkit-ssh-plugin-debuginfo
nbdkit-vddk-plugin-debuginfo
nbdkit-python-plugin
nbdkit-tmpdisk-plugin-debuginfo
nbdkit-xz-filter
nbdkit-example-plugins
nbdkit-example-plugins-debuginfo

Install updates from vendor's website.

nbdkit-ocaml-plugin - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-vddk-plugin - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-help - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-bash-completion - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-server - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-python3-plugin - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-plugins - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-perl-plugin - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-ocaml-plugin-devel - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-libvirt-plugin - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-guestfs-plugin - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-devel - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-debugsource - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-debuginfo - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-basic-plugins - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-basic-filters - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit - addressed in versions 1.29.11-2, 1.32.6-2
nbdkit-server-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-xz-filter-debuginfo - update to 1.36.5-150400.3.9.1
nbdkit-tar-filter-debuginfo - update to 1.36.5-150400.3.9.1
nbdkit-gzip-filter-debuginfo - update to 1.36.5-150400.3.9.1
nbdkit-nbd-plugin-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-curl-plugin-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-nbd-plugin - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-basic-plugins - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-basic-plugins-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-ssh-plugin - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-gzip-filter - update to 1.36.5-150400.3.9.1
nbdkit-linuxdisk-plugin - update to 1.36.5-150400.3.9.1
nbdkit-server - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-vddk-plugin - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-linuxdisk-plugin-debuginfo - update to 1.36.5-150400.3.9.1
nbdkit-python-plugin-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-tmpdisk-plugin - update to 1.36.5-150400.3.9.1
nbdkit-basic-filters-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-debugsource - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-curl-plugin - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-devel - update to 1.36.5-150400.3.9.1
nbdkit-tar-filter - update to 1.36.5-150400.3.9.1
nbdkit-basic-filters - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-ssh-plugin-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-bash-completion - update to 1.36.5-150400.3.9.1
nbdkit-vddk-plugin-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-python-plugin - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-debuginfo - addressed in versions 1.36.5-150400.3.9.1, 1.40.6-150700.4.3.1
nbdkit-tmpdisk-plugin-debuginfo - update to 1.36.5-150400.3.9.1
nbdkit-xz-filter - update to 1.36.5-150400.3.9.1
nbdkit-example-plugins - update to 1.36.5-150400.3.9.1
nbdkit-example-plugins-debuginfo - update to 1.36.5-150400.3.9.1
nbdkit - addressed in versions 1.38.6-1.fc40, 1.40.6-1.fc41, 1.42.3-1.fc42

• https://access.redhat.com/security/cve/CVE-2025-47711
• https://bugzilla.redhat.com/show_bug.cgi?id=2365687

• Multiple vulnerabilities in nbdkit
• Fedora 42 update for nbdkit
• Fedora 41 update for nbdkit
• Fedora 40 update for nbdkit
• openEuler 24.03 LTS SP2 update for nbdkit
• openEuler 24.03 LTS SP1 update for nbdkit
• openEuler 24.03 LTS update for nbdkit
• openEuler 22.03 LTS SP4 update for nbdkit
• openEuler 22.03 LTS SP3 update for nbdkit
• SUSE update for nbdkit
• SUSE update for nbdkit