Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/lxc/incus/v7

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.4GoPublished

    Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

    CVE-2026-47753 · GHSA-8g7m-96c8-8wwc

    Affected
    • Go github.com/lxc/incus/v7 < 7.1.0
    Fixed in
    7.1.0· Vendor fix available
    Issue
    (backend).CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploading a crafted backup tarball. The Incus daemon panics and the process crashes, causing denial of service to every project on that cluster member. This is a sibling of GHSA-fwj8-62r8-8p8m, GHSA-r7w7-mmxr-47r9, and GHSA-x5r6-jr56-89pv (all assigned 2026-05-04). Those patches added guards on adjacent fields of the same backup/config.Config struct; the Volume field on the instance-import path was missed. Vulnerable code internal/server/storage/backend.go (current main, commit 1513600): The caller createFromBackup in cmd/incusd/instancespost.go only verifies that Config and Config.Container are non-nil: Volume is not checked. The Volume field on internal/server/backup/config.Config has type api.StorageVolume with yaml:"volume,omitempty", so omitting volume: from a…

    Recommended action: Upgrade to 7.1.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →