CVE-2025-52889

Published: Jun 25, 2025Modified: Jun 17, 2026Deferred

3.4

Vector

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Exploitability: 1.7 / Impact: 1.4

Source: security-advisories@github.com (Secondary)

Description

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

Related CWEs

CWE-770

Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (4)

https://github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214

Source: security-advisories@github.com

https://github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c

Source: security-advisories@github.com

https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86

Source: security-advisories@github.com

https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.