CVE-2025-47711Off-by-one Error in Redhat Enterprise Linux

CWE-193Off-by-one Error7 documents7 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 45.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJun 9
Latest updateJun 10

Description

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

Also affects: Enterprise Linux 10.0, 7.0, 8.0, 9.0

🔴Vulnerability Details

3
OSV
CVE-2025-47711: There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks2025-06-09
GHSA
GHSA-c8xj-fr2w-pjfc: There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks2025-06-09
CVEList
Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service2025-06-09

📋Vendor Advisories

3
Microsoft
Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service2025-06-10
Red Hat
nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a Denial of Service2025-04-23
Debian
CVE-2025-47711: nbdkit - There's a flaw in the nbdkit server when handling responses from its plugins reg...2025
CVE-2025-47711 — Off-by-one Error in Redhat | cvebase