---
name: "libnbd-security"
section: "3"
platform: "linux"
package: "libnbd"
version: "1.24.4-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libnbd-security"
---

# libnbd-security(3)

information about past security issues in libnbd

## NAME

libnbd-security - information about past security issues in libnbd

## DESCRIPTION

This page details past security issues found in libnbd.

For how to report new security issues, see the `"SECURITY"` file in the top level source directory, also available online here: https://gitlab.com/nbdkit/libnbd/blob/master/SECURITY

### CVE-2019-14842 protocol downgrade attack when using "LIBNBD\_TLS\_REQUIRE"

See the full announcement and links to mitigation, tests and fixes here: https://www.redhat.com/archives/libguestfs/2019-September/msg00128.html

### remote code execution vulnerability

See the full announcement here: https://www.redhat.com/archives/libguestfs/2019-October/msg00060.html

### CVE-2021-20286 denial of service when using nbd\_set\_opt\_mode(3)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2021-March/msg00092.html

### CVE-2022-0485 silent data corruption when using nbdcopy(1)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2022-February/msg00104.html

### integration testing denial of service with block status

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2023-July/032035.html

### CVE-2023-5215 negative size result from nbd\_get\_size(3)

See the full announcement here: https://listman.redhat.com/archives/libguestfs/2023-September/032711.html

### CVE-2023-5871 assertion failure for 64-bit flags passed to nbd\_block\_status(3)

See the full announcement here: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/5CRC7LRTN35WPZZ4BT6NAMH4JGMF47IK/

### CVE-2024-7383 multiple flaws in TLS server certificate checking

See the full announcement here: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2/

### CVE-2025-14946 unsanitized hostnames in nbd+ssh URIs allow remote execution

See the full announcement here: https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/YZMBF3SJRWTRVT5L3KWSNHITFTRMQNTT/

### command injection in nbd+ssh URIs socket and nbd-port parameters

See the following commit for details: https://gitlab.com/nbdkit/libnbd/-/commit/e50bbd2681117c2dd8bb9f2b3f3105c7a9182f5a

## SEE ALSO

[**libnbd**(3)](/libnbd/3.md).

## AUTHORS

Eric Blake

Richard W.M. Jones

## COPYRIGHT

Copyright Red Hat

## LICENSE

This library is free software; you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public License along with this library; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA