CVE-2021-3716: Nbdkit Project Nbdkit

Low severity, CVSS 3.1. EPSS: 0.6% chance of exploitation in the next 30 days.

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.

Affected products

• Nbdkit Project Nbdkit: from 1.11.8, before 1.24.6 (fixed in 1.24.6); from 1.25.1, before 1.26.5 (fixed in 1.26.5); from 1.27.1, before 1.27.6 (fixed in 1.27.6)
• Red Hat Enterprise Linux: version 8.0 only

Published 2022-03-02. Last modified 2026-06-17.