Skip to content
OpenAdvisories

Package · Debian

incus

59 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Low 2.1
    CVE-2026-48754

    Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}

    Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnap…

    lxc incus incus incus Debian Ubuntu Alpine Go
  • Low 2.1
    CVE-2026-48756

    Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)

    Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot…

    lxc incus lxd incus Debian Ubuntu Alpine Go
  • Low 2.3
    CVE-2026-40243

    Incus OVN TLS verification accepts peer-supplied roots and permits endpoint impersonation

    Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS ser…

    lxc incus incus incus Debian Ubuntu Alpine Go
  • Low 3.8
    CVE-2024-6156

    lxd CA certificate sign check bypass

    Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store.

    Canonical LXD lxd incus Debian Ubuntu Go