CVE-2026-33743

EUVD-2026-16464

26.03.2026, 23:16

Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the control plane API. This does not impact any running workload, existing containers and virtual machines will keep operating. Version 6.23.0 fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub_M	CNA	6.5 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Debian Releases

Debian Product

Codename

incus

forky	vulnerable
sid	6.0.6-2 fixed
trixie	vulnerable
trixie (security)	vulnerable

lxd

bookworm	5.0.2-5+deb12u2 fixed
bookworm (security)	5.0.2-5+deb12u3 fixed
trixie	5.0.2+git20231211.1364ae4-9+deb13u3 fixed
trixie (security)	5.0.2+git20231211.1364ae4-9+deb13u3 fixed

Common Weakness Enumeration

CWE-770 - Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References

https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3