Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Xen Security Advisory 512 v3 (CVE-2026-79604) - oxenstored: Unbounded accumulation of watches

oss-security ()2 · 1 read
Read at seclists.org
Part of a story covered by 4 sourcesXen publishes XSA-510 through XSA-513 (v3): four advisories covering hypervisor crashes, data exposure, oxenstored resource exhaustion, and Tapdisk out-of-bounds flawsMerged summary & timeline
AI summary · glm-5.3-flashSummaries by Vani AI

Xen Project released XSA-512 (CVE-2026-79604) fixing unbounded accumulation of watches in oxenstored that can exhaust resources after xenbus reconnects.

Xen Security Advisory 512 v3 publicly discloses CVE-2026-79604 in oxenstored, the OCaml xenstore implementation. Oxenstored maintains a global trie and per-domain hashtable for watches, and on a xenbus reconnect requests the watches are not cleared out of the global structure. This allows unbounded accumulation of watches. The Xen security team published the advisory and fix as a public release.

Key facts
  • CVE-2026-79604 assigned to the oxenstored watch-tracking flaw
  • Affects xenstore watch bookkeeping: global trie not cleared on xenbus reconnect
  • Published as public Xen Security Advisory XSA-512 v3
  • Relevant to Xen deployments using the OCaml oxenstored daemon
Analyze CVE-2026-79604 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-79604
Tags
hypervisoroxenstoredvirtualizationxenxenstorexsa
Vendors
Xen Project
Products
Xenoxenstored
Organizations
Xen Project

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-79604
———

From the original article

Posted by Xen . org security team on Sep 08 Xen Security Advisory CVE-2026-79604 / XSA-512 version 3 oxenstored: Unbounded accumulation of watches UPDATES IN VERSION 3 ==================== Public release. ISSUE DESCRIPTION ================= Oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.