CVE-2025-52889: Incus Allocation of Resources Without Limits allows firewall rule bypass on managed bridge networks

June 26, 2025 (updated March 30, 2026)

When using an ACL on a device connected to a bridge, Incus generates nftables rules for local services (DHCP, DNS…) that partially bypass security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. This can lead to DHCP pool exhaustion and opens the door for other attacks.

References

github.com/advisories/GHSA-9q7c-qmhm-jv86
github.com/lxc/incus
github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214
github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c
github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86
nvd.nist.gov/vuln/detail/CVE-2025-52889

Code Behaviors & Features

Detect and mitigate CVE-2025-52889 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →