PT-2026-37138 · Incus · Incus

Ectario + 1 · Published 2026-05-04 · Updated 2026-05-07 · CVE-2026-41648

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Incus versions prior to 7.0.0

Description Incus is a system container and virtual machine manager. An authenticated user can provide a specially crafted image or backup tarball containing a very large YAML document. Because the software unpacks these tarballs and parses YAML files without size restrictions, the document can be loaded into memory, potentially causing the server to run out of memory and degrade service. This occurs because the getImageMetadata() and backup.GetInfo() functions call the YAML decoder directly on the tar reader without limiting the bytes consumed or checking the hdr.Size of the tar entry. While the system mitigates alias and anchor bombs, large flat YAML documents can still cause memory consumption approximately 5x to 6x the input size.

Recommendations Update to version 7.0.0.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-41648

GHSA-67WX-R9XR-X75X

Affected Products

Incus

References · 13

• 🔥 https://github.com/lxc/incus/security/advisories/GHSA-67wx-r9xr-x75x · Exploit
• https://github.com/lxc/incus/releases/tag/v7.0.0 · Patch
• https://cve.org/CVERecord?id=CVE-2026-41648 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-41648 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41648 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41648 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41648 · Security Note
• https://ubuntu.com/security/CVE-2026-41648 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-67wx-r9xr-x75x · Vendor Advisory
• https://github.com/lxc/incus · Note
• https://github.com/lxc/incus/pull/3273 · Note
• https://t.me/CVEtracker/52980 · Telegram Post
• https://twitter.com/CVEnew/status/2052400760915398892 · Twitter Post