{"id":"UBUNTU-CVE-2025-47711","details":"There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.","modified":"2026-05-20T16:23:31.369769525Z","published":"2025-06-09T06:15:00Z","upstream":["CVE-2025-47711"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2025-47711"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2025-47711"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2365687"}],"affected":[{"package":{"name":"nbdkit","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/nbdkit?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.10-1","1.1.11-1","1.1.11-1build1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.1.11-1build1","binary_name":"nbdkit"},{"binary_name":"nbdkit-plugin-guestfs","binary_version":"1.1.11-1build1"},{"binary_version":"1.1.11-1build1","binary_name":"nbdkit-plugin-libvirt"},{"binary_name":"nbdkit-plugin-perl","binary_version":"1.1.11-1build1"},{"binary_name":"nbdkit-plugin-python","binary_version":"1.1.11-1build1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47711.json"}},{"package":{"name":"nbdkit","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/nbdkit?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.12.4-1","1.12.4-1build1","1.14.2-3","1.16.1-2","1.16.1-3","1.16.1-3ubuntu1","1.16.2-1ubuntu1","1.16.2-1ubuntu2","1.16.2-1ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"nbdkit","binary_version":"1.16.2-1ubuntu3"},{"binary_name":"nbdkit-plugin-guestfs","binary_version":"1.16.2-1ubuntu3"},{"binary_version":"1.16.2-1ubuntu3","binary_name":"nbdkit-plugin-libvirt"},{"binary_version":"1.16.2-1ubuntu3","binary_name":"nbdkit-plugin-lua"},{"binary_name":"nbdkit-plugin-perl","binary_version":"1.16.2-1ubuntu3"},{"binary_name":"nbdkit-plugin-python","binary_version":"1.16.2-1ubuntu3"},{"binary_name":"nbdkit-plugin-ruby","binary_version":"1.16.2-1ubuntu3"},{"binary_version":"1.16.2-1ubuntu3","binary_name":"nbdkit-plugin-tcl"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47711.json"}},{"package":{"name":"nbdkit","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/nbdkit?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.24.1-2ubuntu1","1.24.1-2ubuntu2","1.24.1-2ubuntu3","1.24.1-2ubuntu4"],"ecosystem_specific":{"binaries":[{"binary_name":"nbdkit","binary_version":"1.24.1-2ubuntu4"},{"binary_version":"1.24.1-2ubuntu4","binary_name":"nbdkit-plugin-guestfs"},{"binary_name":"nbdkit-plugin-libvirt","binary_version":"1.24.1-2ubuntu4"},{"binary_name":"nbdkit-plugin-lua","binary_version":"1.24.1-2ubuntu4"},{"binary_name":"nbdkit-plugin-perl","binary_version":"1.24.1-2ubuntu4"},{"binary_version":"1.24.1-2ubuntu4","binary_name":"nbdkit-plugin-python"},{"binary_version":"1.24.1-2ubuntu4","binary_name":"nbdkit-plugin-ruby"},{"binary_name":"nbdkit-plugin-tcl","binary_version":"1.24.1-2ubuntu4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47711.json"}},{"package":{"name":"nbdkit","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/nbdkit?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.34.4-1ubuntu1","1.36.1-1ubuntu1","1.36.2-1ubuntu1","1.36.3-1ubuntu2","1.36.3-1ubuntu3","1.36.3-1ubuntu9","1.36.3-1ubuntu10"],"ecosystem_specific":{"binaries":[{"binary_name":"nbdkit","binary_version":"1.36.3-1ubuntu10"},{"binary_name":"nbdkit-plugin-guestfs","binary_version":"1.36.3-1ubuntu10"},{"binary_version":"1.36.3-1ubuntu10","binary_name":"nbdkit-plugin-libvirt"},{"binary_name":"nbdkit-plugin-lua","binary_version":"1.36.3-1ubuntu10"},{"binary_name":"nbdkit-plugin-perl","binary_version":"1.36.3-1ubuntu10"},{"binary_name":"nbdkit-plugin-python","binary_version":"1.36.3-1ubuntu10"},{"binary_name":"nbdkit-plugin-ruby","binary_version":"1.36.3-1ubuntu10"},{"binary_name":"nbdkit-plugin-tcl","binary_version":"1.36.3-1ubuntu10"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47711.json"}},{"package":{"name":"nbdkit","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/nbdkit?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.42.2-1ubuntu1","1.42.3-1ubuntu1","1.42.4-1ubuntu1","1.42.6-1ubuntu1"],"ecosystem_specific":{"binaries":[{"binary_name":"nbdkit","binary_version":"1.42.6-1ubuntu1"},{"binary_version":"1.42.6-1ubuntu1","binary_name":"nbdkit-plugin-guestfs"},{"binary_name":"nbdkit-plugin-libvirt","binary_version":"1.42.6-1ubuntu1"},{"binary_name":"nbdkit-plugin-lua","binary_version":"1.42.6-1ubuntu1"},{"binary_name":"nbdkit-plugin-perl","binary_version":"1.42.6-1ubuntu1"},{"binary_name":"nbdkit-plugin-python","binary_version":"1.42.6-1ubuntu1"},{"binary_name":"nbdkit-plugin-tcl","binary_version":"1.42.6-1ubuntu1"},{"binary_version":"1.42.6-1ubuntu1","binary_name":"nbdkit-plugin-vddk"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47711.json"}},{"package":{"name":"nbdkit","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/nbdkit?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.42.6-1ubuntu1","1.42.9-1ubuntu1","1.42.9-1ubuntu2","1.46.2-1ubuntu2"],"ecosystem_specific":{"binaries":[{"binary_name":"nbdkit","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-guestfs","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-libvirt","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-lua","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-perl","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-python","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-tcl","binary_version":"1.46.2-1ubuntu2"},{"binary_name":"nbdkit-plugin-vddk","binary_version":"1.46.2-1ubuntu2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2025/UBUNTU-CVE-2025-47711.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}