{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://nbdkit.org/","packageName":"nbdkit","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"1.38.6","status":"affected","version":"1.11.10","versionType":"semver"},{"lessThan":"1.40.6","status":"affected","version":"1.40.0","versionType":"semver"},{"lessThan":"1.42.3","status":"affected","version":"1.42.0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"nbdkit","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"nbdkit","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:rhel/nbdkit","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:8.2/nbdkit","product":"Red Hat Enterprise Linux 8 Advanced Virtualization","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:av/nbdkit","product":"Red Hat Enterprise Linux 8 Advanced Virtualization","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"nbdkit","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nbdkit_project:nbdkit:-:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"},{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","vulnerable":true},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_advanced_virtualization:8.0:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"cveId":"CVE-2025-47711","cwes":["CWE-193"],"description":"There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.","epss":{"date":"2026-11-05","percentile":0.41885,"score":0.00484},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793895436810,"publishedAt":1749449027063,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-47711"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2365687"},{"source":"CNA: redhat","tags":[],"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2025-47711"},{"source":"secalert@redhat.com","tags":["Issue Tracking"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2365687"},{"source":"secalert@redhat.com","tags":[],"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/"}],"remediation":[],"revision":"40b56cafc5e5a81d1354e8bf28d5db652f1f6e4e1352cb426950664353e00264","sources":[{"modifiedAt":1793893791386,"name":"CNA: redhat","retrievedAt":1793895193955,"url":"https://www.cve.org/CVERecord?id=CVE-2025-47711"},{"modifiedAt":1793895436810,"name":"NVD","retrievedAt":1793902610736,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47711"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793895222691,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47711"}],"ssvc":{"assessedAt":1749493178672,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service","updatedAt":1793902610736}