CVE-2026-41685

Katalog CVE

CVSS 4.3 · Medium EPSS 0,39%

Kerentanan Allocation of Resources Without Limits or Throttling pada linuxcontainers incus. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.

Rincian

Terbit di NVD

7 Mei 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp exploit · advisory vendor
• https://github.com/lxc/incus/releases/tag/v7.0.0 patch · product