https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T14:49:44.620754+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2025-08084 bdu:2025-08084 2026-10-02T14:49:44.710002+00:00 bdu:2025-08084 https://cve.radiocsirt.org/vuln/euvd-2026-245856 EUVD-2026-245856 2026-10-02T14:49:44.710039+00:00 EUVD-2026-245856 https://cve.radiocsirt.org/vuln/fkie_cve-2025-52889 fkie_cve-2025-52889 2026-10-02T14:49:44.710053+00:00

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

 https://cve.radiocsirt.org/vuln/ghsa-9q7c-qmhm-jv86 GHSA-9q7c-qmhm-jv86 — Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks 2026-10-02T14:49:44.710084+00:00

Affected: Go: github.com/lxc/incus/v6

### Summary

When using an ACL on a device connected to a bridge, Incus generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks.

### Details

In commit a7c33301738aede3c035063e973b1d885d9bac7c, the following rules are added at the top of the bridge input chain:

iifname "{{.hostName}}" ether type ip ip saddr 0.0.0.0 ip daddr 255.255.255.255 udp dport 67 accept iifname "{{.hostName}}" ether type ip6 ip6 saddr fe80::/10 ip6 daddr ff02::1:2 udp dport 547 accept iifname "{{.hostName}}" ether type ip6 ip6 saddr fe80::/10 ip6 daddr ff02::2 icmpv6 type 133 accept

However, these rules accept packets that should be filtered and maybe dropped by later rules in the "MAC filtering" snippet:

iifname "{{.hostName}}" ether type arp arp saddr ether != {{.hwAddr}} drop iifname "{{.hostName}}" ether type ip6 icmpv6 type 136 @nh,528,48 != {{.hwAddrHex}} drop

Therefore, the MAC filtering is ineffective on those new rules. This allows an attacker to request as many IP as they want by sending a lot of DHCP requests with different MAC addresses. Doing so, they can exhaust the DHCP pool, resulting in a DoS of the bridge's network.

Additionaly, the commit adds non-restricted access to the local dnsmasq DNS server:

{{ if .dnsIPv4 }} {{ range .dnsIPv4 }} iifname "{{$.hostName}}" ip daddr "{{…

 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15317-1 openSUSE-SU-2025:15317-1 — incus-6.14-1.1 on GA media 2026-10-02T14:49:44.710142+00:00

incus-6.14-1.1 on GA media

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-52889 UBUNTU-CVE-2025-52889 2026-10-02T14:49:44.710161+00:00

Affected: Ubuntu:Pro:24.04:LTS: incus, Ubuntu:25.10: incus, Ubuntu:Pro:26.04:LTS: incus

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.