CVE-2026-41648 - Vulnerability Analysis
MediumCVSS: 5.0Last Updated: May 7, 2026
Incus - Denial of Service
Published: May 7, 2026Updated: May 7, 2026PoC AvailableRemote Exploitable
Overview
Incus < 7.0.0 contains a denial of service caused by lack of size restrictions when unpacking user-provided image and backup tarballs, letting authenticated users cause server out-of-memory by loading large YAML documents.
Severity & Score
Severity: Medium
CVSS Score: 5.0
Impact
Authenticated users can cause server out-of-memory, leading to denial of service.
Mitigation
Update to version 7.0.0 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-41648
- Severity
- Medium
- CVSS Score
- 5.0
- Type
- denial_of_service
- Status
- confirmed
CWE
- CWE-770
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L