Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:golang/github.com/lxc/incus/v6@6.19.0
Typegolang
Namespacegithub.com/lxc/incus
Namev6
Version6.19.0
Qualifiers
Subpath
Is_vulnerablefalse
Next_non_vulnerable_version6.21.0
Latest_non_vulnerable_version6.23.0
Affected_by_vulnerabilities
Fixing_vulnerabilities
0
url VCID-9zu5-7km8-57ds
vulnerability_id VCID-9zu5-7km8-57ds
summary Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a container with an attached custom storage volume that has the `security.shifted` property set to `true` as well as access to the host as an unprivileged user. The most common case for this would be systems using `incus-user` with the less privileged `incus` group to provide unprivileged users with an isolated restricted access to Incus. Such users may be able to create a custom storage volume with the necessary property (depending on kernel and filesystem support) and can then write a setuid binary from within the container which can be executed as an unprivileged user on the host to gain root privileges. A patch for this issue is expected in versions 6.0.6 and 6.19.0. As a workaround, permissions can be manually restricted until a patched version of Incus is deployed.
references
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64507.json
reference_id
reference_type
scores
0
value 8.4
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-64507.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2025-64507
reference_id
reference_type
scores
0
value 0.0003
scoring_system epss
scoring_elements 0.09237
published_at 2026-06-14T12:55:00Z
1
value 0.0003
scoring_system epss
scoring_elements 0.09246
published_at 2026-06-12T12:55:00Z
2
value 0.0003
scoring_system epss
scoring_elements 0.09247
published_at 2026-06-13T12:55:00Z
3
value 0.00036
scoring_system epss
scoring_elements 0.11126
published_at 2026-06-11T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2025-64507
2
reference_url https://github.com/lxc/incus
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/lxc/incus
3
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-64507
reference_id
reference_type
scores
0
value 8.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-64507
4
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2413919
reference_id 2413919
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2413919
5
reference_url https://github.com/lxc/incus/issues/2641
reference_id 2641
reference_type
scores
0
value 8.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-11-12T17:35:12Z/
url https://github.com/lxc/incus/issues/2641
6
reference_url https://github.com/lxc/incus/pull/2642
reference_id 2642
reference_type
scores
0
value 8.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-11-12T17:35:12Z/
url https://github.com/lxc/incus/pull/2642
7
reference_url https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf
reference_id GHSA-56mx-8g9f-5crf
reference_type
scores
0
value 8.6
scoring_system cvssv4
scoring_elements CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-11-12T17:35:12Z/
url https://github.com/lxc/incus/security/advisories/GHSA-56mx-8g9f-5crf
fixed_packages
0
url pkg:golang/github.com/lxc/incus/v6@6.19.0
purl pkg:golang/github.com/lxc/incus/v6@6.19.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:golang/github.com/lxc/incus/v6@6.19.0
aliases CVE-2025-64507, GHSA-56mx-8g9f-5crf
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-9zu5-7km8-57ds
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:golang/github.com/lxc/incus/v6@6.19.0