CVE-2025-58146

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI uses libraries which conform to the stricter v3.1 of the Unicode spec. This causes some strings to be accepted as valid UTF-8 by XAPI, but rejected by other libraries in use. Notably, such strings can be entered into the database, after which the database can no longer be loaded. 3. There is no input sanitisation for Map/Set updates on objects in the XAPI database.

• CWE-20

• https://xenbits.xen.org/xsa/advisory-474.html
• http://www.openwall.com/lists/oss-security/2025/09/09/3
• http://xenbits.xen.org/xsa/advisory-474.html

Published

Jul 9, 2026

Last Modified

Jul 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58137Authorization Bypass Through User-Controlled Key vulnerabili…8.1
• CVE-2025-5814The Profiler – What Slowing Down Your WP plugin for WordPres…5.3
• CVE-2025-58142[This CNA information record relates to multiple CVEs; the t…9.8
• CVE-2025-58143[This CNA information record relates to multiple CVEs; the t…9.8
• CVE-2025-58144[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58145[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58147[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58148[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58149When passing through PCI devices, the detach logic in libxl …7.5
• CVE-2025-5815The Traffic Monitor plugin for WordPress is vulnerable to un…5.3
• CVE-2025-58150Shadow mode tracing code uses a set of per-CPU variables to …8.8
• CVE-2025-58151varstored is a component of the Xapi toolstack handling UEFI…9.4