CVE-2025-47711 — Off-by-one Error in Redhat Enterprise Linux
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 45.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 9
Latest updateJun 10
Description
There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6
Affected Packages2 packages
Also affects: Enterprise Linux 10.0, 7.0, 8.0, 9.0
🔴Vulnerability Details
3OSV▶
CVE-2025-47711: There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks↗2025-06-09
GHSA▶
GHSA-c8xj-fr2w-pjfc: There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks↗2025-06-09
CVEList▶
Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service↗2025-06-09
📋Vendor Advisories
3Microsoft▶
Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service↗2025-06-10
Red Hat▶
nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a Denial of Service↗2025-04-23
Debian▶
CVE-2025-47711: nbdkit - There's a flaw in the nbdkit server when handling responses from its plugins reg...↗2025