CVE-2026-23556 — oxenstored keeps quota related use counts across domain destruction

CVE-2026-23556

oxenstored keeps quota related use counts across domain destruction PUBLISHED

Description (CNA)

When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.

Affected (CNA)

Vendor / product	Versions
Xen / oxenstored	affected all

CWE

CWE-281

References

https://xenbits.xen.org/xsa/advisory-483.html

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/04/28/10
http://xenbits.xen.org/xsa/advisory-483.html

CISA-ADP

No English description supplied.

No references supplied.