{"id":"GO-2026-5612","revision":"d612caf2d90e454e834139f58ed014c6","records":[{"revision":"d612caf2d90e454e834139f58ed014c6","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5612","aliases":["CVE-2026-40197","GHSA-r7w7-mmxr-47r9"],"title":"Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus","description":"Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:24.3499015+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v7","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lxc/incus/security/advisories/GHSA-r7w7-mmxr-47r9","https://nvd.nist.gov/vuln/detail/CVE-2026-40197"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5612","license":"OSV · upstream source license applies","key":"osv:GO-2026-5612","identifiers":["GO-2026-5612","CVE-2026-40197","GHSA-r7w7-mmxr-47r9"]},"retained":false,"historicalAffected":[]}],"coverage":[]}