VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/lxc/lxd: vulnerability history, versions and safety

github.com/lxc/lxd is a package in the Go ecosystem. Vulert records 4 vulnerabilities for it across 120 releases, from Apr 2021 to Nov 2025. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
4 vulnerabilities recorded H2 U2
i
1 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
1 in the last 12 months

Most recent disclosure 05 Nov 2025.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/lxc/lxd vulnerabilities

Vulert verdict on github.com/lxc/lxd v0.0.0-20230707070733-fa595dea7577 i

Updated on 23 Oct 2026

Careful: v0.0.0-20230707070733-fa595dea7577 has 3 known vulnerabilities, and 1 has no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 60/100
  • Security Minor issues
  • Maintenance Maintaining
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v0.0.0-20230707070733-fa595dea7577 — affected i
  • Vulnerabilities on record 4 over 4 years · 1 in the last year i
  • Latest disclosure 05 Nov 2025 i
  • Highest CVSS 8.1 i
  • With no published fix 1 i
  • Stars 6,400 i
  • OpenSSF scorecard 6/10 i
  • Last release 39 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 23 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/lxc/lxd, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20230707070733-fa595dea7577 07 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230706101940-0f149b0825f1 06 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230706101940-b284f3c14a9f 06 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230706101814-d1220e9aa5c2 06 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230705083617-288c4de83eb0 05 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230705075534-002109200ba2 05 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230705072557-193f2c4e1f8d 05 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230704200343-97743d8075b4 04 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230704190214-0d1a03296225 04 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230704142307-e71885fdf946 04 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230704100146-1dd7e0740324 04 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230704070356-8d9f3c2026fe 04 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230704035822-d05d299413c0 04 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230703135836-2be007258681 03 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230703094732-91216a83ac82 03 Jul 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230630181437-71fd927db567 30 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230630153220-bf10fd0144a9 30 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230630082128-9a64f645b6c3 30 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230628150835-46a660ea9731 28 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230628101055-5778a550942f 28 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230628094206-28d96c66d831 28 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230627194745-27d54adf8124 27 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230627152726-64eed41c7548 27 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230627142516-85896fd9a1cf 27 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230627094015-b3dfc107cc35 27 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230626173229-415abc4e3b4a 26 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230626154644-57eb058068b0 26 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230626123605-4db7b8ca9f0d 26 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230626074013-98dfba75955e 26 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230626023725-54a62758873e 26 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230624041104-a449a65f9c47 24 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230623104739-7eb62e9c2d4a 23 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230623092807-30a4be612c57 23 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230623085716-77afbd0e6817 23 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230622212906-53db74c16a08 22 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230622170111-ca9015b3055b 22 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230622163646-20f1f971ad71 22 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230622144536-d01004a34bb6 22 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230622140348-82c3075b076a 22 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230622075121-c6eab2e88462 22 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621235229-4ffb515cc314 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621233857-7e8edd19a50f 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621222832-d75ef056a1a1 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621212224-c221a8ac1783 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621171605-0c2f4271a632 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621170644-563b16153b08 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621164141-f73f44e1f92a 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621160254-61d3de3b84ab 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621150758-c4873e0cb916 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621142653-6a7b08f0f81f 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621141558-f502af79ee59 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230621120356-8bfa85230ec6 21 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230620230721-393c053aedf8 20 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230620222921-8c9577cd3ed1 20 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230620222448-8fc9ce30999b 20 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230620135701-b25b3ef31c77 20 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619203039-6bdccb9bb4df 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619174637-0810908e5c1c 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619143752-dfd04314e6a1 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619141916-d085f030b530 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619135358-9350731cf1fa 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619132607-b1f80a9cfcc6 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619091228-e166f5f7f7d1 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230619074359-0b16beb5ed4a 19 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230617150035-47a8cc456432 17 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230616212555-fa47610ca32e 16 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230616205537-d15d42447470 16 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230616172618-1090dcb09ae3 16 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230616131003-66143cfc509e 16 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615193151-fd24f5800bb8 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615174929-26c00ecc6c5d 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615152445-9e2cd6554107 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615133326-1c5eff546b5f 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615131403-94e94e34fa44 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615085846-7ee9b6c3b4ae 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230615071622-289d2e698fad 15 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230614210446-52173fe924f6 14 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230614205825-90881039865e 14 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230613102656-295658462fdf 13 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230613083821-86d842bb9851 13 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230613080417-30bfadb0983f 13 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230613075135-c3f3fbc5aac5 13 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230611045841-bdbac88afa4a 11 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230611032459-5e23b7ceeec9 11 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230611030158-77f0171ff248 11 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230611025926-f26e010bf37f 11 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230611025220-ca997d00722c 11 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230609160027-c6f30b035a09 09 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230609145001-9729783693af 09 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230609135121-d86dac2916d2 09 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230609123410-df786ad657af 09 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230609065922-6517077f1f2d 09 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230609052938-50a56f2d33c4 09 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230607171925-39d30c49ea61 07 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230607155008-5735d9e0cd8f 07 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230607074242-02931b9eae33 07 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230606094025-687c1c10097c 06 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230605145703-123231d27121 05 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230605133623-bb9d72300092 05 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230602174734-a823d11ce39a 02 Jun 2023 H1 U2 Apache-2.0 No Details →
v0.0.0-20230602132852-ce3c156962b8 02 Jun 2023 H1 U2 — No Details →
v0.0.0-20230602123905-8955ec23fb93 02 Jun 2023 H1 U2 — No Details →
v0.0.0-20230602090722-ed51d1a59959 02 Jun 2023 H1 U2 — No Details →
v0.0.0-20230602082019-907ca22a0c85 02 Jun 2023 H1 U2 — No Details →
v0.0.0-20230602081852-c8fdfc432199 02 Jun 2023 H1 U2 — No Details →
v0.0.0-20230602081655-8692afcfe93d 02 Jun 2023 H1 U2 — No Details →
v0.0.0-20230601132014-3e7d8bf7e60b 01 Jun 2023 H1 U2 — No Details →
v0.0.0-20230601041254-d21b5d1d09df 01 Jun 2023 H1 U2 — No Details →
v0.0.0-20230531221334-0988f14f1575 31 May 2023 H1 U2 — No Details →
v0.0.0-20230531164626-2e86ca228d21 31 May 2023 H1 U2 — No Details →
v0.0.0-20230531130537-8333d3dc8d2a 31 May 2023 H1 U2 — No Details →
v0.0.0-20230531110729-061352b96b7d 31 May 2023 H1 U2 — No Details →
v0.0.0-20230531100636-3aaa93d7abf4 31 May 2023 H1 U2 — No Details →
v0.0.0-20230531085802-5e58fd847585 31 May 2023 H1 U2 — No Details →
v0.0.0-20230530201220-99e6387425d6 30 May 2023 H1 U2 — No Details →
v0.0.0-20230530185818-d7bb60cb5e26 30 May 2023 H1 U2 — No Details →
v0.0.0-20230530150701-2491196b9c23 30 May 2023 H1 U2 — No Details →
v0.0.0-20230530103425-ef84f7b00743 30 May 2023 H1 U2 — No Details →
v0.0.0-20230530095821-54316ed02c15 30 May 2023 H1 U2 — No Details →
v0.0.0-20230530091235-b3b18a8431cd 30 May 2023 H1 U2 — No Details →

The newest 120 of 12,697 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2021 1
  • 2022 1
  • 2025 2

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 1 of the 4 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/lxc/lxd

The 4 most severe of 4 vulnerabilities recorded for this package

Search all 4 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2015-1340: LXD Race Condition Vulnerability 8.1 high 0.0.0-20151004155856-19c6961cc101 24 May 2022
CVE-2025-54287: Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns 6.5 high 5.21.4 02 Oct 2025
CVE-2015-1340: Race condition in github.com/lxc/lxd N/A unrated 0.0.0-20151004155856-19c6961cc101 14 Apr 2021
CVE-2025-54287: Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns N/A unrated No fix published 05 Nov 2025

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/lxc/lxd

Is github.com/lxc/lxd safe to use?

Vulert records 4 vulnerabilities for github.com/lxc/lxd in Go: 0 critical, 2 high, 0 medium and 0 low, plus 2 not yet rated. 1 of them has no published fix yet, so that is the one to avoid or mitigate.

What is github.com/lxc/lxd's Vulert package health score?

Vulert scores github.com/lxc/lxd 60/100, which reads as usable, but worth attention. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/lxc/lxd affected?

Yes. v0.0.0-20230707070733-fa595dea7577, the version you would install today, has 3 known vulnerabilities, and 1 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/lxc/lxd should I use?

v0.0.0-20230707070733-fa595dea7577 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/lxc/lxd have?

4 vulnerabilities are recorded for github.com/lxc/lxd in the Go ecosystem: 0 critical, 2 high, 0 medium and 0 low, plus 2 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/lxc/lxd vulnerabilities disclosed?

1 vulnerability was recorded for github.com/lxc/lxd in the last 12 months, and the oldest entry in this database dates to 14 Apr 2021. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/lxc/lxd are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/lxc/lxd for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/lxc/lxd version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.