Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-41685 EUVD-2026-28374GHSA-98vh-x9cx-9cfpGO-2026-5280

Incus: Unbounded binary import disk exhaustion

Published May 7, 2026 · Updated May 7, 2026 · Assigned by GitHub_M

Description

Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.

Affected products

VendorProductAffectedFixed
lxc incus < 7.0.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 incus 7.0.0-1 —
Debian 13 incus 6.0.4-2+deb13u7 —
Debian 13 lxd 5.0.2+git20231211.1364ae4-9+deb13u6 —
Debian 12 lxd No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 incus No fix yet —
Ubuntu 25.10 incus No fix yet —
Ubuntu 20.04 LTS lxd No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS incus No fix yet —
Ubuntu Pro 24.04 LTS incus No fix yet —
Ubuntu Pro 18.04 LTS lxd No fix yet —
Ubuntu Pro 16.04 LTS lxd No fix yet —
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 govulncheck-vulndb 0.0.20260723T184607-160000.1.1 openSUSE-SU-2026:21483-1
ReleasePackageFixed inAdvisory
Alpine v3.24 incus 7.0.0-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/lxc/incus all versions — GO-2026-5280
Go github.com/lxc/incus/v6 all versions — GO-2026-5280
Go github.com/lxc/incus/v6/cmd/incusd <= 6.23.0 — GHSA-98vh-x9cx-9cfp

Advisories 1

References