CVE-2025-52889

Katalog CVE

CVSS 3.4 · Low EPSS 0,25%

Kerentanan Allocation of Resources Without Limits or Throttling. Skor CVSS 3.1 3.4 (Low) menurut github.com.

Deskripsi (NVD)

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

Rincian

Terbit di NVD

25 Juni 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

3.4 (Low), sumber github.com
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214
• https://github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c
• https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86