CVE-2026-41648
published 2026-05-07CVE-2026-41648: Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files…
PriorityP428medium5CVSS 3.1
AVNACLPRLUINSCCNINAL
EPSS
0.27%
18.6th percentile
Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML document being loaded into memory, potentially causing the entire server to run out of memory. This issue has been patched in version 7.0.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lxc_incus_v6_cmd_incusd | 0 – 6.23.0 | — |
| linuxcontainers | incus | < 7.0.0 | 7.0.0 |
| lxc | incus | < 7.0.0 | 7.0.0 |
CVSS provenance
nvdv3.15.0MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
lxc incus up to 6.x YAML File allocation of resources (GHSA-67wx-r9xr-x75x)
vuldb·2026-05-07·CVSS 5.3
CVE-2026-41648 [MEDIUM] lxc incus up to 6.x YAML File allocation of resources (GHSA-67wx-r9xr-x75x)
A vulnerability classified as problematic has been found in lxc incus up to 6.x. This issue affects some unknown processing of the component YAML File Handler. The manipulation leads to allocation of resources.
This vulnerability is documented as CVE-2026-41648. The attack can be initiated remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
Incus has Unbounded YAML Metadata Decode via Parsing
ghsa·2026-05-04
CVE-2026-41648 [LOW] CWE-770 Incus has Unbounded YAML Metadata Decode via Parsing
Incus has Unbounded YAML Metadata Decode via Parsing
### Summary
User provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML document being loaded into memory, potentially causing the entire server to run out of memory.
### Details
It was found that getImageMetadata and backup.GetInfo call yaml.NewDecoder(tr).Decode() directly on the tar reader without limiting how many bytes the YAML decoder can consume. The tar entry hdr.Size is not checked before decoding.
A tar archive can be crafted in which metadata.yaml or backup/index.yaml declares a large size in the tar header, causing the YAM
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41648 incus: Incus: Denial of Service via crafted image or backup tarball [fedora-all]
bugzilla·2026-05-15·CVSS 5.3
CVE-2026-41648 [MEDIUM] CVE-2026-41648 incus: Incus: Denial of Service via crafted image or backup tarball [fedora-all]
CVE-2026-41648 incus: Incus: Denial of Service via crafted image or backup tarball [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41648 incus: Incus: Denial of Service via crafted image or backup tarball
bugzilla·2026-05-07·CVSS 5.3
CVE-2026-41648 [MEDIUM] CVE-2026-41648 incus: Incus: Denial of Service via crafted image or backup tarball
CVE-2026-41648 incus: Incus: Denial of Service via crafted image or backup tarball
Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML document being loaded into memory, potentially causing the entire server to run out of memory. This issue has been patched in version 7.0.0.
2026-05-07
Published