Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M
CVE-2026-33743Incus vulnerable to denial of source through crafted bucket backup file
Medium 6.5
In plain English
A medium-severity resource allocation without limits in incus from lxc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the control plane API. This does not impact any running workload, existing containers and virtual machines will keep operating. Version 6.23.0 fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | incus | 6.0.4-2+deb13u5 | DSA-6184-1 |
| Debian:13 | incus | 6.0.4-2+deb13u5 | DEBIAN-CVE-2026-33743 |
| Debian:14 | incus | 6.0.6-2 | DEBIAN-CVE-2026-33743 |
| Go | github.com/lxc/incus | no fix listed | GO-2026-4886 |
| Go | github.com/lxc/incus | no fix listed | GHSA-vg76-xmhg-j5x3 |
| Go | github.com/lxc/incus/v6 | 6.23.0 | GHSA-vg76-xmhg-j5x3 |
| Go | github.com/lxc/incus/v6 | 6.23.0 | GO-2026-4886 |
| Ubuntu:25.10 | incus | no fix listed | UBUNTU-CVE-2026-33743 |
| Ubuntu:26.10 | incus | no fix listed | UBUNTU-CVE-2026-33743 |
Affected products (as reported)
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3 x_refsource_CONFIRM