What is the CVSS score of EUVD-2025-19115?

EUVD-2025-19115 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Ubuntu are affected by EUVD-2025-19115?

CVE-2025-52889 is a low-severity vulnerability in Incus (CVSS 3.4). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

How to fix or mitigate EUVD-2025-19115?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Ubuntu EUVD-2025-19115

| CVE-2025-52889 LOW

Allocation of Resources Without Limits or Throttling (CWE-770)

2025-06-25 security-advisories@github.com

GHSA-9q7c-qmhm-jv86

Denial Of Service Debian Ubuntu

3.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.4 LOW

AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L

Ubuntu

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2025-19115

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 17:15 nvd

LOW 3.4

DescriptionGitHub Advisory

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options security.mac_filtering, security.ipv4_filtering and security.ipv6_filtering. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214.

Analysis

Technical ContextAI

A denial of service vulnerability allows an attacker to disrupt the normal functioning of a system, making it unavailable to legitimate users. This vulnerability is classified as Allocation of Resources Without Limits or Throttling (CWE-770).

RemediationAI

Implement rate limiting and input validation. Use timeout mechanisms for resource-intensive operations. Deploy DDoS protection where applicable.

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all

CVE-2017-8779 HIGH POC

7.5

CVE-2025-53521 CRITICAL POC

9.3

CVE-2017-5850 HIGH POC

7.5

CVE-2025-26682 HIGH

7.5

CVE-2025-41770 HIGH

8.7

CVE-2025-26466 MEDIUM

5.9

CVE-2020-37067 CRITICAL POC

9.8

CVE-2021-47875 CRITICAL POC

9.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

Ubuntu

Priority: Medium

incus

Release	Status	Version
jammy	DNE	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
questing	needs-triage	-
plucky	ignored	end of life, was needs-triage

Debian

incus

Release	Status	Fixed Version	Urgency
trixie (security), trixie	fixed	6.0.4-2+deb13u4	-
forky	fixed	6.0.5-8	-
sid	fixed	6.0.6-1	-
(unstable)	not-affected	-	-

EUVD-2025-19115 vulnerability details – vuln.today

Back

Ubuntu EUVD-2025-19115

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

Analysis

Technical ContextAI

RemediationAI

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

Same technique Denial Of Service

Vendor StatusVendor

Ubuntu

Debian

Share

External POC / Exploit Code