CVE-2025-58146
Gravedad CVSS v4.0:
CRÍTICA
Tipo:
CWE-20
Validación incorrecta de entrada
Fecha de publicación:
09/07/2026
Última modificación:
09/07/2026
Descripción
*** Pendiente de traducción *** There are multiple issues.<br />
<br />
1. Updates to the XAPI database sanitise input strings, but try<br />
generating the notification using the unsanitised input. This<br />
causes the database&#39;s event thread to terminate and cease further<br />
processing.<br />
<br />
2. XAPI&#39;s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI<br />
uses libraries which conform to the stricter v3.1 of the Unicode<br />
spec. This causes some strings to be accepted as valid UTF-8 by<br />
XAPI, but rejected by other libraries in use. Notably, such strings<br />
can be entered into the database, after which the database can no<br />
longer be loaded.<br />
<br />
3. There is no input sanitisation for Map/Set updates on objects in the<br />
XAPI database.
Impacto
Puntuación base 4.0
9.40
Gravedad 4.0
CRÍTICA