{"id":"EUVD-2026-39789","enisaUuid":"eb03945f-e4c2-3fcd-8d59-388c3b42cdcf","description":"Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.","datePublished":"Jun 26, 2026, 3:39:04 PM","dateUpdated":"Jun 26, 2026, 4:02:11 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8\nhttps://github.com/canonical/lxd/pull/18320\nhttps://github.com/canonical/lxd/pull/18390\n","aliases":"CVE-2026-9639\n","assigner":"canonical","epss":0.55,"enisaIdProduct":[{"id":"12c90426-72e8-3a3c-ba07-5597c43e6180","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"6.0 \u003c6.9"},{"id":"f8f683e6-a9fd-3bf4-a169-0209366802f8","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"5.21.0 \u003c5.21.5"}],"enisaIdVendor":[{"id":"b0d30011-85ba-3821-ab8e-9fc5fb637bb1","vendor":{"name":"Canonical"}}],"enisaIdVulnerability":[{"id":"6a91fcce-a2e9-342f-8151-8abcf54f6056","vulnerability":{"id":"CVE-2026-9639","description":"Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause a denial of service via a specially crafted custom-volume backup tarball that omits the expires_at snapshot field.","datePublished":"Jun 26, 2026, 3:39:04 PM","dateUpdated":"Jun 26, 2026, 4:02:11 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/canonical/lxd/security/advisories/GHSA-j93m-3j9p-m5m8\nhttps://github.com/canonical/lxd/pull/18320\nhttps://github.com/canonical/lxd/pull/18390\n","enisa_id":"EUVD-2026-39789\n","assigner":"canonical","epss":0.55,"dataProcessed":"Nov 6, 2026, 7:19:32 AM","vulnerabilityProduct":[{"id":"90a3867b-138e-3dcf-8ec6-1fc590ee92fb","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"5.21.0 \u003c5.21.5"},{"id":"ad0f4f74-9b95-3c8d-9976-c26c2d8818f4","product":{"name":"LXD","vendor":{"name":"Canonical"}},"product_version":"6.0 \u003c6.9"}],"vulnerabilityVendor":[{"id":"860e2b6f-9cd2-38d0-8c0e-61702856079f","vendor":{"name":"Canonical"}}]}}],"enisaIdAdvisory":[]}