VSA-2026-038: Unbounded accumulation of watches in oxenstored (CVE-2026-79604 / XSA-512)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-09-08 | 2026-09-08 | 🟠Moderate | Not available yet | - XCP-ng 8.3 |
A vulnerability in the Xen hypervisor's oxenstored has been discovered. For Vates products, we classify the impact as Moderate. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
Oxenstored maintains two data structures about watches; one global trie, and one hashtable tracked per domain. When a xenbus reconnect is requested, watches are not cleared out of the global trie.
Impact​
A guest can cause unbounded memory usage in oxenstored. This can lead to a system-wide DoS.
With an oxenstored DoS, domains may keep running but are likely to crash or hang. Either way, they will no longer be configurable or manageable: guest consoles stop working, many actions in Xen Orchestra or via xe fail, and features such as password recovery for an XOA instance become unavailable.
Status​
- 2026-09-08: Released
Affected Versions​
- XCP-ng 8.3: Affected.
Mitigation​
There are no known mitigations.
Resolution​
As of 2026-09-08, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
xen-4.17.6-12.3.xcpng8.3
Credits​
This issue was discovered by Anthropic using agents to study the security of open-source projects, with Ada Logics validating and reporting.