libnbd-security(3) LIBNBD libnbd-security(3)

# [NAME](#NAME)

libnbd-security - information about past security issues in libnbd

# [DESCRIPTION](#DESCRIPTION)

This page details past security issues found in libnbd.

For how to report new security issues, see the "SECURITY" file in the top level source directory, also available online here: https://gitlab.com/nbdkit/libnbd/blob/master/SECURITY

## CVE-2019-14842 protocol downgrade attack when using "LIBNBD\_TLS\_REQUIRE"

See the full announcement and links to mitigation, tests and fixes here: https://www.redhat.com/archives/libguestfs/2019-September/msg00128.html

## [remote code execution vulnerability](#remote_code_execution_vulnerability)

See the full announcement here: https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html

## CVE-2021-20286 denial of service when using [**nbd\_set\_opt\_mode**(3)](/man/os/libnbd/nbd_set_opt_mode.3)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html

## CVE-2022-0485 silent data corruption when using [**nbdcopy**(1)](/man/os/libnbd/nbdcopy.1)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2022-February/msg00104.html

## [integration testing denial of service with block status](#integration_testing_denial_of_service_with_block_status)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2023-July/032035.html

## CVE-2023-5215 negative size result from [**nbd\_get\_size**(3)](/man/os/libnbd/nbd_get_size.3)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2023-September/032711.html

## CVE-2023-5871 assertion failure for 64-bit flags passed to [**nbd\_block\_status**(3)](/man/os/libnbd/nbd_block_status.3)

See the full announcement here: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/5CRC7LRTN35WPZZ4BT6NAMH4JGMF47IK/

## CVE-2024-7383 multiple flaws in TLS server certificate checking

See the full announcement here: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2/

## CVE-2025-14946 unsanitized hostnames in nbd+ssh URIs allow remote execution

See the full announcement here: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/YZMBF3SJRWTRVT5L3KWSNHITFTRMQNTT/

## [command injection in nbd+ssh URIs socket and nbd-port parameters](#command_injection_in_nbd+ssh_URIs_socket_and_nbd)

See the following commit for details: https://gitlab.com/nbdkit/libnbd/-/commit/e50bbd2681117c2dd8bb9f2b3f3105c7a9182f5a

# [SEE ALSO](#SEE_ALSO)

[**libnbd**(3)](/man/os/libnbd/libnbd.3).

# [AUTHORS](#AUTHORS)

Eric Blake

Richard W.M. Jones

# [COPYRIGHT](#COPYRIGHT)

Copyright Red Hat

# [LICENSE](#LICENSE)

This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

2026-09-11 libnbd-1.25.7

---

Document: libnbd-security(3) from libnbd 1.25.7-r2 (Chainguard OS)