CVE-2026-41685

Incus: Unbounded binary import disk exhaustion

View on CVE.org
Published May 7, 2026 CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Description
Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.

Analysis

AI-generated

Technical impact

An authenticated user can upload arbitrarily large amounts of data to the Incus server before version 7.0.0, causing the server to consume excessive disk space and potentially bring the host system down. The vulnerability is an instance of resource exhaustion (CWE-770) and directly impacts the Confidentiality, Integrity, and Availability of the host environment by risking service interruption.

Affected Systems

The affected product is the Incus container and virtual machine manager (lxc:incus) running any version earlier than 7.0.0. Users who upload large datasets without using the default IncusOS storage volumes for images or backups are at risk.

Risk and Exploitability

The CVSS score of 4.3 indicates moderate severity, and the absence of an EPSS score means that the exact exploitation probability is not quantified. This issue is not listed in CISA's KEV catalog, suggesting that it has not yet been widely exploited. The anticipated attack vector is a legitimate authenticated user leveraging the upload functionality to drain host disk resources; thus preventing or limiting such uploads mitigates the risk.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Incus version 7.0.0 or later.
  • Configure upload destinations to use storage.images_volume or storage.backups_volume to prevent host disk usage.
  • Impose limits on upload size or enforce quotas to restrict large data transfers.

Generated by OpenCVE AI on May 7, 2026 at 14:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-6244-1 incus security update
Debian DSA Debian DSA DSA-6247-1 lxd security update
Github GHSA Github GHSA GHSA-98vh-x9cx-9cfp Incus is affected by unbounded binary import disk exhaustion
History
Type Values Removed Values Added
First Time appeared Linuxcontainers
Linuxcontainers incus
CPEs cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*
Vendors & Products Linuxcontainers
Linuxcontainers incus
Type Values Removed Values Added
First Time appeared Lxc
Lxc incus
Vendors & Products Lxc
Lxc incus
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.
Title Incus: Unbounded binary import disk exhaustion
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}
Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
May 7, 2026, 1:50 PM
Reserved
Apr 22, 2026, 3:53 AM

View source JSON

Updated
May 7, 2026, 1:50 PM

JSON

Status
Analyzed
Published
May 7, 2026, 2:16 PM
Modified
Oct 26, 2026, 8:10 PM

View source JSON

No data.

Updated
May 7, 2026, 3:15 PM

JSON