VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/lxc/incus: vulnerability history, versions and safety

github.com/lxc/incus is a package in the Go ecosystem. Vulert records 32 vulnerabilities for it across 120 releases, from Jul 2025 to Sep 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
32 vulnerabilities recorded U32
i
32 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
30 in the last 12 months

Most recent disclosure 02 Sep 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/lxc/incus vulnerabilities

Vulert verdict on github.com/lxc/incus v0.7.0 i

Updated on 23 Oct 2026

Careful: v0.7.0 has 32 known vulnerabilities, and 32 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 50/100
  • Security Unfixed issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.7.0 — affected i
  • Vulnerabilities on record 32 over 1 year · 30 in the last year i
  • Latest disclosure 02 Sep 2026 i
  • Highest CVSS n/a i
  • With no published fix 32 i
  • Stars 6,400 i
  • OpenSSF scorecard 6/10 i
  • Last release 30 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/lxc/incus, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.7.1-0.20240527213326-c51b247911ea 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240527213324-2b4eb2cb065e 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240527213320-4409e362cf0e 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240527213317-4e56a8bda2e7 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240527213314-f76bba6f245d 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240527213311-8c39430af9fb 27 May 2024 U32 Apache-2.0 No Details →
v0.0.0-20240527213308-8c6ef2cfb294 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240527213308-8c6ef2cfb294 27 May 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240408172410-2122c2212e96 08 Apr 2024 U32 Apache-2.0 No Details →
v0.0.0-20240405032632-74c3c71cb13f 05 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240405032632-74c3c71cb13f 05 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240404040807-dbfe0531e582 04 Apr 2024 U32 Apache-2.0 No Details →
v0.0.0-20240403221957-714bcc5e42b1 03 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240403221957-714bcc5e42b1 03 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240403003435-4828b967266c 03 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240402022355-e6809f87b76f 02 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240401025912-e0f0abc9ee00 01 Apr 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240329203711-18a13cd3a40e 29 Mar 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240329175203-ec8d61aef08e 29 Mar 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240329034300-8c6d7d69e6e9 29 Mar 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240328232153-b965408c26a9 28 Mar 2024 U32 Apache-2.0 No Details →
v0.7.1-0.20240327222740-ab4849163f30 27 Mar 2024 U32 Apache-2.0 No Details →
v0.0.0-20240326010636-4e7e5b43d038 26 Mar 2024 U32 Apache-2.0 No Details →
v0.7.0 26 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240316105321-16ffaac095f1 16 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240315173900-077a4d77b29f 15 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240315134945-502a32fea363 15 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240309172205-0d5f33f13875 09 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240308064523-9b075dc214d6 08 Mar 2024 U32 Apache-2.0 No Details →
v0.0.0-20240306143326-823db2f45225 06 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240306143326-823db2f45225 06 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240304155236-c64a0ed4359e 04 Mar 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240229234418-95bc49d27a8e 29 Feb 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240229165050-e83b747f8a46 29 Feb 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240226140458-450b91febf41 26 Feb 2024 U32 Apache-2.0 No Details →
v0.6.1-0.20240224043810-047c76dce58d 24 Feb 2024 U32 Apache-2.0 No Details →
v0.0.0-20240222215827-ae403538e2d1 22 Feb 2024 U32 Apache-2.0 No Details →
v0.6.0 22 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240222144100-e02f2a52740e 22 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240222065307-66e4e7ec5049 22 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240222043727-e37e1f5090b8 22 Feb 2024 U32 Apache-2.0 No Details →
v0.0.0-20240221022852-f210cba053d3 21 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240221022852-f210cba053d3 21 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240217003233-d81cb32ac9c5 17 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240213133206-4a5dfbce17e2 13 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240212224318-0b445eddd553 12 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240210030523-94e1eb59d130 10 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240208235516-f3ddfe52b9e1 08 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240208163119-6f47978ad0e8 08 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240207210712-2856ce4b0d1d 07 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240206222538-5c4fe4921077 06 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240203134524-e224ed94f6ce 03 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240202165413-2cb70c762e87 02 Feb 2024 U32 Apache-2.0 No Details →
v0.0.0-20240202012927-96c64fd86a32 02 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240202012927-96c64fd86a32 02 Feb 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240131015252-ee9020081915 31 Jan 2024 U32 Apache-2.0 No Details →
v0.5.2-0.20240129015256-6f8dafabe9d6 29 Jan 2024 U32 Apache-2.0 No Details →
v0.0.0-20240128180722-017e426e9e38 28 Jan 2024 U32 Apache-2.0 No Details →
v0.5.1 28 Jan 2024 U32 Apache-2.0 No Details →
v0.5.1-0.20240127221020-fc136bab1e24 27 Jan 2024 U32 Apache-2.0 No Details →
v0.5.1-0.20240127072740-fcbaa563e948 27 Jan 2024 U32 Apache-2.0 No Details →
v0.5.1-0.20240126152926-53d066a07640 26 Jan 2024 U32 Apache-2.0 No Details →
v0.5.1-0.20240126011358-42a2fbdafc0f 26 Jan 2024 U32 Apache-2.0 No Details →
v0.5.0 25 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240124223134-c2e4d78dbacd 24 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240124082627-9dec883d4180 24 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240122211913-e9c674c87428 22 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240122140925-3a561ce6f1a8 22 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240122050512-1f37c612653b 22 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240121084812-b1fae6d3c4d1 21 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240121022507-91fb5c02bd88 21 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240119223554-529e86cd91d9 19 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240117223800-a95bef9b66c2 17 Jan 2024 U32 Apache-2.0 No Details →
v0.0.0-20240115020802-0d187a9b73fa 15 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240115020802-0d187a9b73fa 15 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240112030210-f2a48b29b5bd 12 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240111064004-386cbe2df4dc 11 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240109212046-f1d5f8fe8ac3 09 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240108212844-b1687e64aaa8 08 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240105162535-05388963a492 05 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240104181154-0b641c0f2af6 04 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240102212212-e1d3c40e417f 02 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20240101064351-f23a57794b34 01 Jan 2024 U32 Apache-2.0 No Details →
v0.4.1-0.20231230101715-f22fc9b6d7a2 30 Dec 2023 U32 Apache-2.0 No Details →
v0.4.1-0.20231229190009-2604ff852561 29 Dec 2023 U32 Apache-2.0 No Details →
v0.4.1-0.20231222184426-ad6fd0e978a2 22 Dec 2023 U32 Apache-2.0 No Details →
v0.4.1-0.20231222035024-032e0405bceb 22 Dec 2023 U32 Apache-2.0 No Details →
v0.4.0 21 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231221041535-7527f273d927 21 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231219000134-0100ba8f3deb 19 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231215233351-9d1cb7b41fad 15 Dec 2023 U32 Apache-2.0 No Details →
v0.0.0-20231215145534-1719ffcbab9d 15 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231215145534-1719ffcbab9d 15 Dec 2023 U32 Apache-2.0 No Details →
v0.0.0-20231215040203-ab5bee11885c 15 Dec 2023 U32 Apache-2.0 No Details →
v0.0.0-20231213123424-ea892336a4aa 13 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231213123424-ea892336a4aa 13 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231209095658-82231b1cbedf 09 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231207224453-f09e9b67ac9e 07 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231207004107-1b78620e1425 07 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231205212122-5056a5ee34ca 05 Dec 2023 U32 Apache-2.0 No Details →
v0.3.1-0.20231205012731-ec92b32b903a 05 Dec 2023 U32 — No Details →
v0.3.1-0.20231202023029-c3125011d8ec 02 Dec 2023 U32 — No Details →
v0.3.1-0.20231201152139-7c692fa778ca 01 Dec 2023 U32 — No Details →
v0.3.1-0.20231129225010-f700f9f40466 29 Nov 2023 U32 — No Details →
v0.3.1-0.20231129035159-bff7d01223ca 29 Nov 2023 U32 — No Details →
v0.0.0-20231126172557-9e9ff11c16e5 26 Nov 2023 U32 — No Details →
v0.3.0 26 Nov 2023 U32 — No Details →
v0.0.0-20231126104059-5caebf06ca25 26 Nov 2023 U32 — No Details →
v0.0.0-20231125093139-81b8e80553d3 25 Nov 2023 U32 — No Details →
v0.0.0-20231125051331-e510a1d8504b 25 Nov 2023 U32 — No Details →
v0.0.0-20231124070951-e35fb8b9ab1c 24 Nov 2023 U32 — No Details →
v0.2.1-0.20231124070951-e35fb8b9ab1c 24 Nov 2023 U32 — No Details →
v0.0.0-20231123133811-6e532c49d1c0 23 Nov 2023 U32 — No Details →
v0.0.0-20231122181127-578056bd4734 22 Nov 2023 U32 — No Details →
v0.0.0-20231122172814-2fd7e7913d54 22 Nov 2023 U32 — No Details →
v0.0.0-20231121110156-8be078d66542 21 Nov 2023 U32 — No Details →
v0.0.0-20231121043345-da1889e30317 21 Nov 2023 U32 — No Details →
v0.0.0-20231119100017-3a87050f3891 19 Nov 2023 U32 — No Details →
v0.2.1-0.20231119100017-3a87050f3891 19 Nov 2023 U32 — No Details →
v0.0.0-20231118223123-cb1d0725588d 18 Nov 2023 U32 — No Details →

The newest 120 of 272 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 3
  • 2026 29

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 30 of the 32 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/lxc/incus

The 5 most severe of 32 vulnerabilities recorded for this package

Search all 32 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-52889: github.com/lxc/incus - Firewall Rule Bypass on Managed Bridge Networks N/A unrated No fix published 28 Jul 2025
CVE-2025-52890: Vulnerability in github.com/lxc/incus - Nftables Rules Bypass Security Options N/A unrated No fix published 28 Jul 2025
CVE-2026-41684: Nil Dereferences Vulnerability in github.com/lxc/incus N/A unrated No fix published 25 Jun 2026
CVE-2026-23953: Newline Injection Vulnerability in github.com/lxc/incus Container Environment Configuration N/A unrated No fix published 05 Feb 2026
CVE-2026-55622: Project Restriction Bypass in github.com/lxc/incus N/A unrated No fix published 02 Sep 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/lxc/incus

Is github.com/lxc/incus safe to use?

Vulert records 32 vulnerabilities for github.com/lxc/incus in Go: 0 critical, 0 high, 0 medium and 0 low, plus 32 not yet rated. 32 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/lxc/incus's Vulert package health score?

Vulert scores github.com/lxc/incus 50/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/lxc/incus affected?

Yes. v0.7.0, the version you would install today, has 32 known vulnerabilities, and 32 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/lxc/incus should I use?

v0.7.1-0.20240527213326-c51b247911ea is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/lxc/incus have?

32 vulnerabilities are recorded for github.com/lxc/incus in the Go ecosystem: 0 critical, 0 high, 0 medium and 0 low, plus 32 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/lxc/incus vulnerabilities disclosed?

30 vulnerabilities were recorded for github.com/lxc/incus in the last 12 months, and the oldest entry in this database dates to 28 Jul 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/lxc/incus are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/lxc/incus for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/lxc/incus version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.