CVE-2026-33743
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Mar 26, 2026
CISA due date
—
The record
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a specially crafted storage bucket backup can be used by an user with access to Incus' storage bucket feature to crash the Incus daemon. Repeated use of this attack can be used to keep the server offline causing a denial of service of the control plane API. This does not impact any running workload, existing containers and virtual machines will keep operating. Version 6.23.0 fixes the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | incus | 0 | 6.23-1.1 |
Related vulnerabilities
- CVE-2026-33898 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33945 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33542 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33711 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-33897 Incus is a system container and virtual machine manager. Also affects incus
- CVE-2026-23954 Incus container image templating arbitrary host file read and write Also affects incus
- CVE-2026-23953 Incus container environment configuration newline injection Also affects incus
- CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled… CWE-770