CVE-2019-14851 Denial of service in nbdkit

What is CVE-2019-14851?

CVE-2019-14851 is a medium-severity denial of service vulnerability in nbdkit, published on 18 Mar 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assertion failure, causing nbdkit to exit. This issue only affected nbdkit versions 1.12.7, 1.14.1, and 1.15.1.

Weakness: CWE-617

Which versions are affected by CVE-2019-14851?

It affects 1 product.

Products include Nbdkit Project Nbdkit.

How do I fix CVE-2019-14851?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-14851 being exploited?

There is no known exploitation of CVE-2019-14851 in the wild and no public exploit code.

Other vulnerabilities in nbdkit

• CVE-2025-47711 Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service Medium 6.5
• CVE-2025-47712 Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service Medium 6.5
• CVE-2019-14850 Denial of service in nbdkit Low 3.7
• CVE-2021-3716 Other in nbdkit Low 3.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-14851, GHSA-hj75-x8cx-fm4w, UBUNTU-CVE-2019-14851.