CVSS 3.1
3.4 lowCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:LCVE-2025-52889
Low (3.4). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in github.com/lxc/incus/v6 6.14.0.
Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWE
- CWE-770
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9q7c-qmhm-jv86 | Go | github.com/lxc/incus/v6 | <6.14.0 | 6.14.0 |
| GO-2025-3781 | Go | github.com/lxc/incus | all versions | no fix published |
| GO-2025-3781 | Go | github.com/lxc/incus/v6 | >=6.12.0 <6.14.0 | 6.14.0 |