PT-2026-28522 · Incus+1 · Incus+1

Stamparm · Published 2026-01-01 · Updated 2026-05-04 · CVE-2026-33743

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Incus versions prior to 6.23.0

Description Incus, a system container and virtual machine manager, contains a flaw where a specially crafted storage bucket backup can be used by a user with access to the storage bucket feature to crash the Incus daemon. Repeated exploitation of this issue can lead to a denial of service of the control plane API. This does not affect running containers or virtual machines. The issue is due to an unchecked string slicing vulnerability in the S3 transfer manager, specifically during S3 restore operations. The code fails to validate header names before slicing strings, and a malicious archive containing a header name shorter than expected can trigger a slice-bounds panic, terminating the daemon. The vulnerable code is located in the UploadAllFiles function within the internal/server/storage/s3/transfer manager.go file.

Recommendations Update Incus to version 6.23.0 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2026-07368

CVE-2026-33743

GHSA-VG76-XMHG-J5X3

GO-2026-4886

OPENSUSE-SU-2026:10450-1

Affected Products

Incus

Red Os

References · 29

• 🔥 https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33743.json · Exploit
• https://osv.dev/vulnerability/GHSA-vg76-xmhg-j5x3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-33743 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33743 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4886 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33743 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33743 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33743 · Security Note
• https://ubuntu.com/security/CVE-2026-33743 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33743 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10450-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07368 · Security Note
• https://github.com/lxc/incus/commit/4bca6332e8227a5f25f74b51a66b7382e9133aaa · Note
• https://github.com/lxc/incus/releases/tag/v6.23.0 · Note