MediumFix available
incus, lxd — security advisory
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
- Products
- incus, lxd
- Affected versions
- 5.0.2+git20231211.1364ae4-1, 5.0.2+git20231211.1364ae4-2, 5.0.2+git20231211.1364ae4-3, 5.0.2+git20231211.1364ae4-4, 5.0.2+git20231211.1364ae4-5, 5.0.2+git20231211.1364ae4-6, 5.0.2+git20231211.1364ae4-7, 5.0.2+git20231211.1364ae4-8, 5.0.2+git20231211.1364ae4-9, 5.0.2+git20231211.1364ae4-9+deb13u1, 5.0.2+git20231211.1364ae4-9+deb13u2, 5.0.2+git20231211.1364ae4-9+deb13u3, 5.0.2+git20231211.1364ae4-9+deb13u4, 5.0.2+git20231211.1364ae4-9+deb13u5, 5.0.2+git20231211.1364ae4-9+deb13u6, 5.0.2+git20231211.1364ae4-9+deb13u7, 5.0.2-5, 5.0.2-5+deb12u1, 5.0.2-5+deb12u2, 5.0.2-5+deb12u3, 5.0.2-5+deb12u4, 5.0.2-5+deb12u5, 5.0.2-5+deb12u6, 5.0.2-6, 6.0.4-2, 6.0.4-2+deb13u1~bpo12+1, 6.0.4-3
- Fixed versions
- 6.0.4-2+deb13u1, 6.0.5-1
- CVEs
- CVE-2025-54291
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 09:03 UTC · Revision 1
Source evidence
Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.
osv:DEBIAN-CVE-2025-54291
incus
Fixed versions: 6.0.4-2+deb13u1
incus
Fixed versions: 6.0.5-1
lxd
Fixed versions: Not specified
lxd
Fixed versions: Not specified
Complete source record
{
"id": "2990ba2bd79b33b85a70e4850d5529c4ec11a31cb826b19f54732a191b8d4a8a",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2025-54291",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2025-54291",
"summary": "Information disclosure in images API in Canonical LXD before 6.5 and 5.21.4 on all platforms allows unauthenticated remote attackers to determine project existence via differing HTTP status code responses.",
"evidence": "osv:DEBIAN-CVE-2025-54291",
"products": [
{
"name": {
"value": "incus",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.4-2+deb13u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "6.0.4-2",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.4-2+deb13u1~bpo12+1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "incus",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.0.5-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": [
{
"value": "6.0.4-2",
"evidence": "/affected/1/versions"
},
{
"value": "6.0.4-3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "lxd",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.2+git20231211.1364ae4-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-2",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-3",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-4",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-5",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-6",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-7",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-8",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5+deb12u1",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5+deb12u2",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5+deb12u3",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5+deb12u4",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5+deb12u5",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-5+deb12u6",
"evidence": "/affected/2/versions"
},
{
"value": "5.0.2-6",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "lxd",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.2+git20231211.1364ae4-9",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u1",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u2",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u3",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u4",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u5",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u6",
"evidence": "/affected/3/versions"
},
{
"value": "5.0.2+git20231211.1364ae4-9+deb13u7",
"evidence": "/affected/3/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2025-54291",
"aliases": [
"DEBIAN-CVE-2025-54291"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.4-2+deb13u1"
}
]
}
],
"package": {
"name": "incus",
"purl": "pkg:deb/debian/incus?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"6.0.4-2",
"6.0.4-2+deb13u1~bpo12+1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54291.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.0.5-1"
}
]
}
],
"package": {
"name": "incus",
"purl": "pkg:deb/debian/incus?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"6.0.4-2",
"6.0.4-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54291.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "lxd",
"purl": "pkg:deb/debian/lxd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"5.0.2+git20231211.1364ae4-1",
"5.0.2+git20231211.1364ae4-2",
"5.0.2+git20231211.1364ae4-3",
"5.0.2+git20231211.1364ae4-4",
"5.0.2+git20231211.1364ae4-5",
"5.0.2+git20231211.1364ae4-6",
"5.0.2+git20231211.1364ae4-7",
"5.0.2+git20231211.1364ae4-8",
"5.0.2+git20231211.1364ae4-9",
"5.0.2-5",
"5.0.2-5+deb12u1",
"5.0.2-5+deb12u2",
"5.0.2-5+deb12u3",
"5.0.2-5+deb12u4",
"5.0.2-5+deb12u5",
"5.0.2-5+deb12u6",
"5.0.2-6"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54291.json"
},
"ecosystem_specific": {
"urgency": "end-of-life"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "lxd",
"purl": "pkg:deb/debian/lxd?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"5.0.2+git20231211.1364ae4-9",
"5.0.2+git20231211.1364ae4-9+deb13u1",
"5.0.2+git20231211.1364ae4-9+deb13u2",
"5.0.2+git20231211.1364ae4-9+deb13u3",
"5.0.2+git20231211.1364ae4-9+deb13u4",
"5.0.2+git20231211.1364ae4-9+deb13u5",
"5.0.2+git20231211.1364ae4-9+deb13u6",
"5.0.2+git20231211.1364ae4-9+deb13u7"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-54291.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-13T09:47:37.730955912Z",
"provider": "osv",
"upstream": [
"CVE-2025-54291"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2025-54291"
]
},
"related_cves": [
{
"value": "CVE-2025-54291",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 307578,
"published_at": "2025-10-02T10:15:39.387+00:00"
}