Xen Security Advisory 512 v3 (CVE-2026-79604) - oxenstored: Unbounded accumulation of watches
Xen Project released XSA-512 (CVE-2026-79604) fixing unbounded accumulation of watches in oxenstored that can exhaust resources after xenbus reconnects.
Xen Security Advisory 512 v3 publicly discloses CVE-2026-79604 in oxenstored, the OCaml xenstore implementation. Oxenstored maintains a global trie and per-domain hashtable for watches, and on a xenbus reconnect requests the watches are not cleared out of the global structure. This allows unbounded accumulation of watches. The Xen security team published the advisory and fix as a public release.
- CVE-2026-79604 assigned to the oxenstored watch-tracking flaw
- Affects xenstore watch bookkeeping: global trie not cleared on xenbus reconnect
- Published as public Xen Security Advisory XSA-512 v3
- Relevant to Xen deployments using the OCaml oxenstored daemon
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-79604 | NVD description · AI analysis pending | — | — | — | — | — |
Posted by Xen . org security team on Sep 08 Xen Security Advisory CVE-2026-79604 / XSA-512 version 3 oxenstored: Unbounded accumulation of watches UPDATES IN VERSION 3 ==================== Public release. ISSUE DESCRIPTION ================= Oxenstored maintains two datastructures about watches; one global trie, and one hashtable tracked per domain. When a xenbus reconnect is requested, watches are not cleared out of the global...
This source does not provide full text. Read it at seclists.org.