Back to overview

CVE-2026-42493

HIGH
7.5
CVSS 3.1
Description
Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.

Metadata

CVE ID
CVE-2026-42493
State
PUBLISHED
Assigner
XEN
Reserved
2026-04-27 14:20 UTC
Published
2026-07-28 12:31 UTC
Last updated
2026-07-28 16:33 UTC
Primary CWE
CWE-400
CWE-400 Uncontrolled Resource Consumption
Vendor / Product
Xen / Xen
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
Xen Xen — consult Xen advisory XSA-495
Weakness (CWE)
CWESourceDescription
CWE-400 adp CWE-400 Uncontrolled Resource Consumption
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References (1)
Back to overview