CVE-2025-58146 (GCVE-0-2025-58146)
Vulnerability from cvelistv5
Published
2026-07-09 14:42
Modified
2026-07-09 16:07
Severity ?
9.4 (Critical) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE
  • CWE-20 - Improper input validation
Summary
There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI uses libraries which conform to the stricter v3.1 of the Unicode spec. This causes some strings to be accepted as valid UTF-8 by XAPI, but rejected by other libraries in use. Notably, such strings can be entered into the database, after which the database can no longer be loaded. 3. There is no input sanitisation for Map/Set updates on objects in the XAPI database.
References
Impacted products
Vendor Product Version
Xen XAPI Version: all
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-09T15:04:54.978Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/09/09/3"
          },
          {
            "url": "http://xenbits.xen.org/xsa/advisory-474.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-58146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-09T16:07:50.376243Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-09T16:07:56.939Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "XAPI",
          "vendor": "Xen",
          "versions": [
            {
              "status": "affected",
              "version": "all"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered by Edwin T\u00f6r\u00f6k from XenServer."
        }
      ],
      "datePublic": "2025-09-09T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eThere are multiple issues.\n\n 1. Updates to the XAPI database sanitise input strings, but try\n    generating the notification using the unsanitised input.  This\n    causes the database\u0027s event thread to terminate and cease further\n    processing.\n\n 2. XAPI\u0027s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\n    uses libraries which conform to the stricter v3.1 of the Unicode\n    spec.  This causes some strings to be accepted as valid UTF-8 by\n    XAPI, but rejected by other libraries in use.  Notably, such strings\n    can be entered into the database, after which the database can no\n    longer be loaded.\n\n 3. There is no input sanitisation for Map/Set updates on objects in the\n    XAPI database.\u003c/pre\u003e"
            }
          ],
          "value": "There are multiple issues.\n\n 1. Updates to the XAPI database sanitise input strings, but try\n    generating the notification using the unsanitised input.  This\n    causes the database\u0027s event thread to terminate and cease further\n    processing.\n\n 2. XAPI\u0027s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\n    uses libraries which conform to the stricter v3.1 of the Unicode\n    spec.  This causes some strings to be accepted as valid UTF-8 by\n    XAPI, but rejected by other libraries in use.  Notably, such strings\n    can be entered into the database, after which the database can no\n    longer be loaded.\n\n 3. There is no input sanitisation for Map/Set updates on objects in the\n    XAPI database."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-272",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-272 Protocol Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-09T14:42:22.690Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xen.org/xsa/advisory-474.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "XAPI UTF-8 string handling",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2025-58146",
    "datePublished": "2026-07-09T14:42:22.690Z",
    "dateReserved": "2025-08-26T06:48:41.443Z",
    "dateUpdated": "2026-07-09T16:07:56.939Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2025/09/09/3\"}, {\"url\": \"http://xenbits.xen.org/xsa/advisory-474.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-07-09T15:04:54.978Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-58146\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-07-09T16:07:50.376243Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-07-09T16:07:54.384Z\"}}], \"cna\": {\"title\": \"XAPI UTF-8 string handling\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered by Edwin T\\u00f6r\\u00f6k from XenServer.\"}], \"impacts\": [{\"capecId\": \"CAPEC-272\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-272 Protocol Manipulation\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 9.4, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"LOCAL\", \"baseSeverity\": \"CRITICAL\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Xen\", \"product\": \"XAPI\", \"versions\": [{\"status\": \"affected\", \"version\": \"all\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-09-09T12:00:00.000Z\", \"references\": [{\"url\": \"https://xenbits.xen.org/xsa/advisory-474.html\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"There are multiple issues.\\n\\n 1. Updates to the XAPI database sanitise input strings, but try\\n    generating the notification using the unsanitised input.  This\\n    causes the database\u0027s event thread to terminate and cease further\\n    processing.\\n\\n 2. XAPI\u0027s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\\n    uses libraries which conform to the stricter v3.1 of the Unicode\\n    spec.  This causes some strings to be accepted as valid UTF-8 by\\n    XAPI, but rejected by other libraries in use.  Notably, such strings\\n    can be entered into the database, after which the database can no\\n    longer be loaded.\\n\\n 3. There is no input sanitisation for Map/Set updates on objects in the\\n    XAPI database.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cpre\u003eThere are multiple issues.\\n\\n 1. Updates to the XAPI database sanitise input strings, but try\\n    generating the notification using the unsanitised input.  This\\n    causes the database\u0027s event thread to terminate and cease further\\n    processing.\\n\\n 2. XAPI\u0027s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\\n    uses libraries which conform to the stricter v3.1 of the Unicode\\n    spec.  This causes some strings to be accepted as valid UTF-8 by\\n    XAPI, but rejected by other libraries in use.  Notably, such strings\\n    can be entered into the database, after which the database can no\\n    longer be loaded.\\n\\n 3. There is no input sanitisation for Map/Set updates on objects in the\\n    XAPI database.\u003c/pre\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"CWE-20 Improper input validation\"}]}], \"providerMetadata\": {\"orgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"shortName\": \"XEN\", \"dateUpdated\": \"2026-07-09T14:42:22.690Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-58146\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-07-09T16:07:56.939Z\", \"dateReserved\": \"2025-08-26T06:48:41.443Z\", \"assignerOrgId\": \"23aa2041-22e1-471f-9209-9b7396fa234f\", \"datePublished\": \"2026-07-09T14:42:22.690Z\", \"assignerShortName\": \"XEN\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.