{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "cveMetadata": {
    "cveId": "MOKSHA-2026-0063",
    "assignerOrgId": "moksha.dk",
    "x_moksha_note": "Self-issued advisory. MOKSHA-2026-NNNN is not a MITRE CVE ID. Schema follows CVE JSON 5.1 for tooling compatibility. alternateIds contains GCVE cross-references (GNA #117) and will also carry MITRE CVE IDs if assigned.",
    "state": "PUBLISHED",
    "datePublished": "2026-04-24T06:00:00Z",
    "alternateIds": [
      "GCVE-117-2026-0063"
    ],
    "x_moksha_semantic_id": "VQP-3"
  },
  "containers": {
    "cna": {
      "providerMetadata": {
        "orgId": "moksha.dk",
        "shortName": "Moksha",
        "dateUpdated": "2026-04-24T06:00:00Z"
      },
      "title": "Negative kbps Injection in VIF.qos_algorithm_params",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vm-admin in XAPI-based hypervisors (XenServer, XCP-ng) can inject negative kbps values into VIF.qos_algorithm_params. XAPI parses via Int64.of_string without sign validation. xenopsd computes a negative bytes_per_interval which fails the >0L bounds check, silently dropping the rate limit. The XAPI database shows the negative value as the configured rate while no rate is enforced in xenstore, creating an observability gap for administrators and monitoring tools."
        }
      ],
      "metrics": [
        {
          "format": "CVSS",
          "cvssV3_1": {
            "version": "3.1",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM"
          }
        },
        {
          "format": "CVSS",
          "cvssV4_0": {
            "version": "4.0",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM"
          }
        }
      ],
      "affected": [
        {
          "vendor": "Cloud Software Group",
          "product": "XenServer",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Vates",
          "product": "XCP-ng",
          "versions": [
            {
              "status": "affected",
              "version": "all",
              "versionType": "custom"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "lang": "en",
              "description": "Improper Input Validation",
              "cweId": "CWE-20",
              "type": "CWE"
            }
          ]
        }
      ],
      "references": [
        {
          "url": "https://gna.moksha.dk/MOKSHA-2026-0063"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakob Wolffhechel, Moksha"
        }
      ]
    }
  },
  "x_gcve": [
    {
      "vulnId": "GCVE-117-2026-0063",
      "recordType": "advisory",
      "relationships": [
        {
          "destId": "MOKSHA-2026-0063",
          "type": "equal"
        }
      ]
    }
  ]
}