CVE-2019-14850

Severity: low (CVSS 3.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-03-18 · updated 2026-06-17
Weakness: CWE-406

Description

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Affected products

nbdkit: before 1.12.7; from 1.14.0 before 1.14.1; from 1.15.0 before 1.15.1 — fixed in 1.12.7, 1.14.1, 1.15.1
Red Hat Enterprise Linux: 8.0
RedHat Enterprise Linux Server: 7.0
RedHat Virtualization: 4.0

How to fix

Upgrade to a fixed version: nbdkit 1.12.7, 1.14.1, 1.15.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-14850 or the next vulnerability affects your stack