{"cve":"CVE-2026-33743","nvd":{"published":"2026-03-26T23:16:20.583","modified":"2026-06-17T10:38:01.380","status":"Analyzed","description":"Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the control plane API. This does not impact any running workload, existing containers and virtual machines will keep operating. Version 6.23.0 fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-770"],"references":["https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3","https://github.com/lxc/incus/security/advisories/GHSA-vg76-xmhg-j5x3"],"products":["linuxcontainers:incus"],"source":"nvd","synced_at":"2026-10-19T22:28:18.033120106+00:00"},"epss":{"cve":"CVE-2026-33743","score":0.00392,"percentile":0.33335,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-vg76-xmhg-j5x3","url":"https://osv.dev/vulnerability/GHSA-vg76-xmhg-j5x3","summary":"Incus vulnerable to denial of source through crafted bucket backup file","modified":"2026-04-07T15:26:03.241983931Z","packages":[{"ecosystem":"Go","name":"github.com/lxc/incus/v6","purl":"pkg:golang/github.com/lxc/incus/v6","ranges":["<6.23.0"],"fixed":["6.23.0"]},{"ecosystem":"Go","name":"github.com/lxc/incus","purl":"pkg:golang/github.com/lxc/incus","ranges":["<=0.7.0"],"fixed":[]}]},{"id":"GO-2026-4886","url":"https://osv.dev/vulnerability/GO-2026-4886","summary":"Incus vulnerable to denial of source through crafted bucket backup file in github.com/lxc/incus","modified":"2026-04-07T15:15:41.695854Z","packages":[{"ecosystem":"Go","name":"github.com/lxc/incus","purl":"pkg:golang/github.com/lxc/incus","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/lxc/incus/v6","purl":"pkg:golang/github.com/lxc/incus/v6","ranges":["<6.23.0"],"fixed":["6.23.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}