CVE-2026-41685
published 2026-05-07CVE-2026-41685: Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.33%
25.4th percentile
Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | lxc_incus_v6_cmd_incusd | 0 – 6.23.0 | — |
| linuxcontainers | incus | < 7.0.0 | 7.0.0 |
| lxc | incus | < 7.0.0 | 7.0.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
lxc incus up to 6.x allocation of resources (GHSA-98vh-x9cx-9cfp)
vuldb·2026-05-07·CVSS 4.3
CVE-2026-41685 [MEDIUM] lxc incus up to 6.x allocation of resources (GHSA-98vh-x9cx-9cfp)
A vulnerability was found in lxc incus up to 6.x. It has been declared as problematic. This affects an unknown function. Executing a manipulation can lead to allocation of resources.
The identification of this vulnerability is CVE-2026-41685. The attack may be launched remotely. There is no exploit available.
It is recommended to upgrade the affected component.
GHSA
Incus is affected by unbounded binary import disk exhaustion
ghsa·2026-05-04
CVE-2026-41685 [MEDIUM] CWE-770 Incus is affected by unbounded binary import disk exhaustion
Incus is affected by unbounded binary import disk exhaustion
### Summary
Uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system.
The impact here is limited for anyone using `storage.images_volume` and `storage.backups_volume` as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS.
### Details
Multiple binary import paths accept application/octet-stream requests and stream the HTTP request body directly into temporary files on the host without any visible request-size limit on the upload path.
When these endpoints receive binary content, the daemon routes the request body into import routines that create tempo
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-41685 incus: Incus: Denial of Service via large data uploads [fedora-all]
bugzilla·2026-05-12·CVSS 4.3
CVE-2026-41685 [MEDIUM] CVE-2026-41685 incus: Incus: Denial of Service via large data uploads [fedora-all]
CVE-2026-41685 incus: Incus: Denial of Service via large data uploads [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Bugzilla
CVE-2026-41685 lxc/incus: Incus: Denial of Service via large data uploads
bugzilla·2026-05-07·CVSS 4.3
CVE-2026-41685 [MEDIUM] CVE-2026-41685 lxc/incus: Incus: Denial of Service via large data uploads
CVE-2026-41685 lxc/incus: Incus: Denial of Service via large data uploads
Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.
2026-05-07
Published