A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Nbdkit | Nbdkit_project | 1.11.8 (including) | 1.24.6 (excluding) |
| Nbdkit | Nbdkit_project | 1.25.1 (including) | 1.26.5 (excluding) |
| Nbdkit | Nbdkit_project | 1.27.1 (including) | 1.27.6 (excluding) |