{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://nbdkit.org/","packageName":"nbdkit","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"1.38.6","status":"affected","version":"1.21.16","versionType":"semver"},{"lessThan":"1.40.6","status":"affected","version":"1.40.0","versionType":"semver"},{"lessThan":"1.42.3","status":"affected","version":"1.42.0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"nbdkit","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"nbdkit","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:rhel/nbdkit","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:8.2/nbdkit","product":"Red Hat Enterprise Linux 8 Advanced Virtualization","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"virt:av/nbdkit","product":"Red Hat Enterprise Linux 8 Advanced Virtualization","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"nbdkit","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cpeConfigurations":[{"negate":false,"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:nbdkit_project:nbdkit:-:*:*:*:*:*:*:*","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*","vulnerable":false},{"criteria":"cpe:2.3:o:redhat:enterprise_linux_advanced_virtualization:8.0:*:*:*:*:*:*:*","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveId":"CVE-2025-47712","cwes":["CWE-190"],"description":"A flaw exists in the nbdkit \"blocksize\" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.","epss":{"date":"2026-11-05","percentile":0.44782,"score":0.00527},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":6.5,"severity":"medium","source":"NVD: nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793895437090,"publishedAt":1749448721198,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-47712"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2365724"},{"source":"CNA: redhat","tags":[],"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2025-47712"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Third Party Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2365724"},{"source":"secalert@redhat.com","tags":["Third Party Advisory"],"url":"https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/"}],"remediation":[],"revision":"efb3777eb02f3a9d48516c953c266f4ffaa67c84b9ac49bbca0d45735df89cef","sources":[{"modifiedAt":1793893794806,"name":"CNA: redhat","retrievedAt":1793895195068,"url":"https://www.cve.org/CVERecord?id=CVE-2025-47712"},{"modifiedAt":1793895437090,"name":"NVD","retrievedAt":1793902610970,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-47712"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793895222612,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-47712"}],"ssvc":{"assessedAt":1749493420258,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service","updatedAt":1793902610970}