Critical severity · published Jul 9, 2026
CVE-2026-23556
oxenstored keeps quota related use counts across domain destruction
9.4
CVSS
0.1%
EPSS
No
On KEV
Description
When oxenstored is tearing a domain down, the node data is cleaned up
but the usage counts are leaked.
When the domain ID is eventually reused, the new domain can create fewer
nodes before beeing deemed to be over quota.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OX
oxenstored · Xen
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23556
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23556
xenbits.xen.org
https://xenbits.xen.org/xsa/advisory-483.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/04/28/10
xenbits.xen.org
http://xenbits.xen.org/xsa/advisory-483.html