CVE-2026-23556

When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.

CVSS

No CVSS.

References

Link	Resource
https://xenbits.xen.org/xsa/advisory-483.html
http://www.openwall.com/lists/oss-security/2026/04/28/10
http://xenbits.xen.org/xsa/advisory-483.html

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Cuando oxenstored está desmontando un dominio, los datos del nodo se limpian pero los recuentos de uso se filtran. Cuando el ID del dominio se reutiliza finalmente, el nuevo dominio puede crear menos nodos antes de ser considerado que excede la cuota.

Information

Published : 2026-07-09 16:16

Updated : 2026-10-25 17:10

NVD link : CVE-2026-23556

Mitre link : CVE-2026-23556

CVE.ORG link : CVE-2026-23556

JSON object : View

Products Affected

No product.

CWE

CWE-281

Improper Preservation of Permissions

{"id": "CVE-2026-23556", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23556", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-09T15:34:22.728700Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@xen.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.4, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@xen.org", "affectedData": [{"vendor": "Xen", "product": "oxenstored", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-09T16:16:38.690", "references": [{"url": "https://xenbits.xen.org/xsa/advisory-483.html", "source": "security@xen.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/28/10", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://xenbits.xen.org/xsa/advisory-483.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@xen.org", "description": [{"lang": "en", "value": "CWE-281"}]}], "descriptions": [{"lang": "en", "value": "When oxenstored is tearing a domain down, the node data is cleaned up\nbut the usage counts are leaked.\n\nWhen the domain ID is eventually reused, the new domain can create fewer\nnodes before beeing deemed to be over quota."}, {"lang": "es", "value": "Cuando oxenstored est\u00e1 desmontando un dominio, los datos del nodo se limpian pero los recuentos de uso se filtran.\n\nCuando el ID del dominio se reutiliza finalmente, el nuevo dominio puede crear menos nodos antes de ser considerado que excede la cuota."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security@xen.org"}