CVE-2025-47712

EUVD-2025-17436
A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 50%
Affected Products (NVD)
VendorProductVersion
nbdkit_projectnbdkit
-
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nbdkit
bookworm
no-dsa
bullseye
postponed
forky
1.46.2-4
fixed
sid
1.46.2-4
fixed
trixie
1.42.3-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nbdkit
focal
needs-triage
jammy
needs-triage
noble
needs-triage
oracular
ignored
plucky
ignored
questing
needs-triage
resolute
needs-triage
xenial
ignored
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
nbdkit
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-basic-filters
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-basic-plugins
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-curl-plugin
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-nbd-plugin
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-python-plugin
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-server
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-ssh-plugin
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
nbdkit-vddk-plugin
suse enterprise sap 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise sap 15 SP7
1.40.6-150700.4.3.1
fixed
suse enterprise server 15 SP6
1.36.5-150400.3.9.1
fixed
suse enterprise server 15 SP7
1.40.6-150700.4.3.1
fixed
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2025-47712
https://bugzilla.redhat.com/show_bug.cgi?id=2365724
https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/67E7AASHHADIY7VAD3FFW2I67LTWVWYF/