CVE-2026-23556oxenstored keeps quota related use counts across domain destruction

When oxenstored is tearing a domain down, the node data is cleaned up but the usage counts are leaked. When the domain ID is eventually reused, the new domain can create fewer nodes before beeing deemed to be over quota.

9.4 CRITICALEPSS 0.13%Not in KEVNVD: Deferred

Last updated: 2026-10-25 17:10 UTC

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
9.4	CRITICAL	4.0XEN (CNA)	CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

CVE ID: CVE-2026-23556
Status: Deferred
Assigner (CNA): XEN
Published: Jul 9, 2026
Last modified: 2026-10-25 17:10 UTC
Weaknesses: CWE-281 · Improper preservation of permissions

Sources

NVD
CVE.org
CISA KEV
FIRST EPSS

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:32 UTC.