---
id: CVE-2024-7383
title: 'Libnbd: nbd server improper certificate validation'
summary: >-
  A flaw was found in libnbd. The client did not always correctly verify the NBD
  server's certificate when using TLS to connect to an NBD server. This issue
  allows a man-in-the-middle attack on NBD traffic.
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-295
vendor: Red Hat
product: libnbd
affected:
  - libnbd >= 1.18.0 < 1.18.5
  - libnbd >= 1.20.0 < 1.20.2
  - 'virt-devel:rhel (all versions)'
  - 'virt:rhel (all versions)'
  - libnbd (all versions)
  - libnbd (all versions)
  - 'virt:av/libnbd (all versions)'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2024-08-06T16:15:33.971325Z'
published: '2024-08-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T14:43:59.819Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-7383'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2024:6757'
    label: 'RHSA-2024:6757'
  - url: 'https://access.redhat.com/errata/RHSA-2024:6964'
    label: 'RHSA-2024:6964'
  - url: 'https://access.redhat.com/security/cve/CVE-2024-7383'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2302865'
    label: RHBZ#2302865
  - url: >-
      https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/message/LHR3BW6RJ7K4BJBQIYV3GTZLSY27VZO2
  - url: >-
      https://lists.libguestfs.org/archives/list/guestfs@lists.libguestfs.org/thread/ENZY4LHLARA3N4C3JUNLPYUCXHFO7BWQ/
tags:
  - cve.org
epss: 0.0039
epssPercentile: 0.33327
ingestedAt: '2026-11-05T21:36:00.882Z'
---

## Overview

A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.

## Affected

- `libnbd >= 1.18.0 < 1.18.5`
- `libnbd >= 1.20.0 < 1.20.2`
- `virt-devel:rhel (all versions)`
- `virt:rhel (all versions)`
- `libnbd (all versions)`
- `libnbd (all versions)`
- `virt:av/libnbd (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.