CVE catalog

CVE-2025-47711

nbdkit: CVE-2025-47711

Severity: Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Apr 23, 2025, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.46% · Oct 25, 2026

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	nbdkit	sid	`1.48.1-1`	fixed
Debian	nbdkit	forky	`1.48.1-1`	fixed
Debian	nbdkit	trixie	`1.42.3-1`	fixed
Debian	nbdkit	bookworm	`1.32.5-1`	vulnerable
Opensuse	nbdkit	tumbleweed	`1.42.3-1.1`	fixed
Suse	nbdkit	linux enterprise module for server applications 15 sp6	`1.36.5-150400.3.9.1`	fixed
Opensuse	nbdkit	leap 15.6	`1.36.5-150400.3.9.1`	fixed
Suse	nbdkit	linux enterprise module for server applications 15 sp7	`1.40.6-150700.4.3.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	nbdkit	source	sid	`1.42.3-1`	not yet assigned	Not reported	[1105227]
Debian	nbdkit	source	forky	`1.42.3-1`	not yet assigned	Not reported	[1105227]
Debian	nbdkit	source	trixie	`1.42.3-1`	not yet assigned	Not reported	[1105227]
Debian	nbdkit	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1105227]
Opensuse	nbdkit	rpm	tumbleweed	`1.42.3-1.1`	Not reported	OPENSUSE-SU-2025:15088-1	Not reported
Suse	nbdkit	rpm	linux enterprise module for server applications 15 sp6	`1.36.5-150400.3.9.1`	Not reported	SUSE-SU-2025:01889-1	Not reported
Opensuse	nbdkit	rpm	leap 15.6	`1.36.5-150400.3.9.1`	Not reported	SUSE-SU-2025:01889-1	Not reported
Suse	nbdkit	rpm	linux enterprise module for server applications 15 sp7	`1.40.6-150700.4.3.1`	Not reported	SUSE-SU-2025:01888-1	Not reported

[Debian bug #1105227]

Notes

[bookworm] nbdkit: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[nbdkit]Affected
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-dev]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-guestfs]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-libvirt]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-lua]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-perl]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-python]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-ruby]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
[nbdkit-plugin-tcl]Affected
Source package: [nbdkit]
Details (2)
- 1.32.5-1 · amd64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12
- 1.32.5-1 · arm64 · bookworm
  Affected
  dsa · nbdkit · debian · bookworm; dsa · nbdkit · debian · 12

[openSUSE Tumbleweed]

[nbdkit-bash-completion]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-basic-filters]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-basic-plugins]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-bzip2-filter]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-curl-plugin]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-devel]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-example-plugins]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-gcs-plugin]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-linuxdisk-plugin]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-nbd-plugin]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed
[nbdkit-python-plugin]Unknown
Source package: [nbdkit]
Details (1)
- 1.48.0-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.42.3-1.1
  Version impact unknown
  dsa · nbdkit · opensuse · tumbleweed

Next results

Observed: Oct 24, 2026, 10:21:48 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]