CVE-2026-42493

HighCVSS 7.5/10Last modified Jul 28, 2026

Description

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be okay to run.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Jul 28, 2026
Last modified: Jul 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-424946.1[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The direct CVE-2026-424955.5[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The direct CVE-2026-424969.1Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_specia CVE-2026-424977.5Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory. _make_special_f CVE-2026-424987.3Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat. This issue affec CVE-2026-424997.5Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.CVE-2026-42502.5A vulnerability was found in Albert Sağlık Hizmetleri ve Ticaret Albert Health up to 1.7.3 on Android. Affected is an unknown function of th CVE-2026-425005.3Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.CVE-2026-425017.5A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This CVE-2026-425026.1Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attac CVE-2026-425038.8gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value wi CVE-2026-425047.5Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.