Critical Xenstore Vulnerability in Xen Package: Denial of Service Risk
Summary
ALPINE-CVE-2026-23555: Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Affects xen versions < 4.18.5-r5. Fixed in 4.18.5-r5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Xen package is a popular open-source hypervisor that enables the creation and management of virtual machines. It is widely used in cloud computing and virtualization environments due to its efficiency and flexibility. However, it has been found to contain a vulnerability in the Xenstore component, which is responsible for managing the communication between domains. This vulnerability can lead to a denial of service, affecting the stability of the hypervisor and the virtual machines running on it.
Vulnerability Detail
The vulnerability arises from an improper handling of Xenstore commands that access the illegal node path '/local/domain/'. When a guest attempts to access this path, it triggers a crash in the xenstored service due to a clobbered error indicator. This crash is caused by a failing assert() statement in xenstored. If xenstored is compiled with NDEBUG defined, the unprivileged guest's access attempt will result in xenstored no longer servicing that guest, leading to potential denial of service for that specific domain, while other guests may still function normally. This vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
4.18.5-r5
This is the first release that contains the fix.
sudo apk add --upgrade xenTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned to mitigate this vulnerability other than updating to the patched versions. However, it is advisable to restrict access to the Xenstore commands for unprivileged guests to prevent exploitation.
Conclusion
The Xenstore vulnerability in the Xen package poses a significant risk of denial of service for guest domains. It is crucial to update to the patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for xen →
FAQ
The vulnerability can lead to a denial of service for the affected guest domain, causing it to crash and become unresponsive.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
The affected versions include all versions prior to the patched versions: 4.18.5-r5 for Alpine v3.20, 4.19.4-r2 for Alpine v3.21, and 4.20.2-r2 for Alpine v3.22 and v3.23.
While there are no specific workarounds, limiting access to Xenstore commands for unprivileged guests can help reduce the risk.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for xen.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
