CVE-2026-41685
Disk Space Exhaustion in Incus Container Manager
Publication date: 2026-05-07
Last updated on: 2026-05-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| canonical | incus | to 7.0.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-41685 is a moderate severity vulnerability in Incus versions prior to 7.0.0 that allows authenticated users to exhaust the disk space on the host system by uploading arbitrarily large amounts of data.
The issue arises because the Incus daemon streams HTTP request bodies directly into temporary files without enforcing size limits, enabling attackers to fill up storage until the system fails or crashes.
Vulnerable endpoints include instance backup imports, storage bucket imports, storage volume imports, and ISO uploads, all of which write data to disk before validation.
While users with configured storage volumes (storage.images_volume and storage.backups_volume) mitigate some risk, the default behavior on IncusOS remains exposed.
The vulnerability was patched in version 7.0.0 by implementing request size limits before data is written to disk.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing authenticated users to upload large amounts of data that exhaust the disk space on the host system.
When disk space is exhausted, the Incus server and potentially the entire host system can become unavailable or crash, leading to denial of service.
Users who do not use storage.images_volume or storage.backups_volume are more exposed, as uploads are stored directly on the host filesystem.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusually large or sustained uploads to the Incus server, especially through endpoints related to instance backup imports, storage bucket imports, storage volume imports, and ISO uploads.
Since the issue involves disk space exhaustion caused by large uploads, checking disk usage and identifying processes or connections that are uploading large amounts of data can help detect exploitation attempts.
- Use commands like `df -h` to monitor disk space usage on the host system.
- Use `lsof | grep /tmp` or similar to identify large temporary files being created by the Incus daemon.
- Monitor network connections with `netstat -anp | grep <incus_process>` or `ss -tp` to identify active uploads to the Incus server.
- Use system monitoring tools to track sustained high network upload activity from authenticated users.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Incus server to version 7.0.0 or later, where this vulnerability has been patched.
Until the upgrade can be performed, consider configuring storage.images_volume and storage.backups_volume to store large uploads on separate volumes rather than the host filesystem, as this reduces the risk of exhausting the host disk space.
Additionally, monitor disk usage closely and restrict authenticated user upload sizes if possible.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.