{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "XenServer",
          "vendor": "Cloud Software Group",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "XCP-ng",
          "vendor": "Vates",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can set VIF.qos_algorithm_params kbps and timeslice_us values that cause Int64 overflow in the bytes_per_interval computation at device.ml:835-845. OCaml silently wraps on integer overflow, producing unexpected rate values. xenopsd bounds checking catches most overflow results, but edge cases where the wrapped value falls within the valid range produce rate limits unrelated to the configured kbps. The field has zero map_keys_roles entries."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-24T06:00:00Z",
        "orgId": "moksha.dk",
        "shortName": "Moksha"
      },
      "references": [
        {
          "url": "https://cna.moksha.dk/MOKSHA-2026-0088"
        }
      ],
      "title": "Int64 Overflow in bytes_per_interval via VIF.qos_algorithm_params"
    }
  },
  "cveMetadata": {
    "alternateIds": [
      "GCVE-117-2026-0088"
    ],
    "assignerOrgId": "moksha.dk",
    "cveId": "MOKSHA-2026-0088",
    "datePublished": "2026-04-24T06:00:00Z",
    "state": "PUBLISHED",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned."
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}