CVE-2019-14850

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

A denial of service vulnerability was discovered in nbdkit 1.12.7, 1.14.1 and 1.15.1. An attacker could connect to the nbdkit service and cause it to perform a large amount of work in initializing backend plugins, by simply opening a connection to the service. This vulnerability could cause resource consumption and degradation of service in nbdkit, depending on the plugins configured on the server-side.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-406

Affected software

No affected versions have been published.

Timeline

Published: Mar 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148516.5A denial of service vulnerability was discovered in nbdkit. A client issuing a certain sequence of commands could possibly trigger an assert CVE-2019-148527.5A flaw was found in 3scale’s APIcast gateway that enabled the TLS 1.0 protocol. An attacker could target traffic using this weaker protocol CVE-2019-148537.5An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unex CVE-2019-148546.5OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Deb CVE-2019-148557.5A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this CVE-2019-148566.5ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None CVE-2019-148576.1A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019 CVE-2019-148585.5A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub param CVE-2019-148599.1A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without CVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL CVE-2019-148606.5It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack CVE-2019-148615.3All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC