CVE-2025-47711

There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.

This vulnerability was rated as a Moderate severity by the Red Hat Product Security team. Based on the fact that while this vulnerability can be exploited remotely (AV:N) with relative ease (AC:L), it does require the attacker to have valid credentials to the target (PR:L). The primary impact is a temporary denial-of-service (A:L), meaning the server becomes unavailable, potentially disrupting dependent services. However, this exploitation does not lead to any compromise of data confidentiality (C:N) or integrity (I:N).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.