CVE-2025-47711: nbdkit_project nbdkit Off-by-one Error
Vulnerability summary
CVE-2025-47711 is a medium (CVSS 6.5) Off-by-one Error vulnerability in nbdkit_project nbdkit. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 39.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 09-06-2025PublishedVulnerability first disclosed.
- 30-06-2026Last modifiedVulnerability information updated.
Description
There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.01 pp
From 0.45% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat2 products
- enterprise_linuxEOL7.0 | 8.0 | 9.0 | 10.0
- enterprise_linux_advanced_virtualization8.0
Debian1 product
- nbdkitAll versions (No fix recorded) | < 1.42.3-1
Nbdkit_project1 product
- nbdkitna
Ubuntu1 product
- nbdkitAll versions (No fix recorded)
4 vendors · 5 products
