CVE-2026-23557Disclosure(xen / xen)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.

xen CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

Weakness type (CWE)

CWE-617

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-04-29); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

xen

Products

xen

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Open Source Security mailing list@oss_security164d
Disclosure
6 Xen Security Advisories 483 v2 (CVE-2026-23556): oxenstored keeps quota related use counts across domain destruction https://www.openwall.com/lists/oss-security/2026/04/28/10 484 v2 (CVE-2026-23557): Xenstored DoS via XS_RESET_WATCHES command https://www.openwall.com/lists/oss-security/2026/04/28/11 1/3
Post summary
Both CVE‑2026‑23556 and CVE‑2026‑23557 are newly disclosed Xen vulnerabilities affecting quota handling and causing a denial‑of‑service via XS_RESET_WATCHES, with technical details provided in the advisory links.
11070501
4.7K followersView on X
CVE@CVEnew143d
Disclosure
CVE-2026-23557 Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDE… https://www.cve.org/CVERecord?id=CVE-2026-23557
Post summary
The post announces a new CVE (CVE-2026-23557) affecting xenstored, describing a crash scenario triggered by an XS_RESET_WATCHES command, with no evidence of a PoC, exploit, active use, or patch.
00000137
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	xen	xen	-	-	-

Explore more

Back to dashboard xen CVEs xen vulnerabilities