Every CVE Search/ Get API key

CVE-2019-14850

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker...

3.7 LowFix available

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.60%Up 0.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 3.7

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
CVE-2019-14850
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0
2.6 LowAV:N/AC:H/Au:N/C:N/I:N/A:P
Weakness
CWE-406
Updated
2026-11-02
CVE List No score

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
CVE-2019-14850
Weakness
CWE-406
Updated
2026-11-02
EUVDEUVD-2019-5973 No score

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
EUVD-2019-5973
Updated
2026-11-03
GitHub AdvisoriesGHSA-j552-f62v-mc74 No score

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker...

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
GHSA-j552-f62v-mc74
Weakness
CWE-406
Updated
2026-11-02
OSV 3.7

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
CVE-2019-14850
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVDEBIAN-CVE-2019-14850 3.7

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
DEBIAN-CVE-2019-14850
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVRHSA-2020:1167 3.7

Red Hat Security Advisory: nbdkit security and bug fix update

Record
RHSA-2020:1167
CVSS 3.0
3.7 LowCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2019-14850 3.7

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Record
UBUNTU-CVE-2019-14850
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nbdkit
Debian:12
 before 1.14.1-1
1.14.1-1
nbdkit
Debian:13
 before 1.14.1-1
1.14.1-1
nbdkit
Debian:14
 before 1.14.1-1
1.14.1-1
nbdkit
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit-plugin-python-common
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit-plugin-python2
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit-plugin-vddk
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit-basic-plugins
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit-devel
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
Show 4 moreShow less
Affected packages
PackageAffectedFixed
nbdkit-example-plugins
Red Hat:enterprise_linux:7::server
 before 0:1.8.0-3.el7
0:1.8.0-3.el7
nbdkit
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.10-11.1.11-11.1.11-1build1
 None known
nbdkit
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.12.4-11.12.4-1build11.14.2-31.16.1-21.16.1-3
Show 4 moreShow less
1.16.1-3ubuntu11.16.2-1ubuntu11.16.2-1ubuntu21.16.2-1ubuntu3
 None known
nbdkit
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.24.1-2ubuntu11.24.1-2ubuntu21.24.1-2ubuntu31.24.1-2ubuntu4
 None known

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-14850 is a low vulnerability (CVSS 3.7) in Microsoft Nbdkit, published March 18, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. Fixed in nbdkit 1.14.1-1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open