The version of AHV installed on the remote host is prior to AHV-11.0. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0 advisory.

  - There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could     exceed the number of columns available. This could lead to a memory corruption issue. We recommend     upgrading to version 3.50.2 or above. (CVE-2025-6965)

  - ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings     in tinfo/read_entry.c in the terminfo library. (CVE-2022-29458)

  - There is a defect in the CPython tarfile module affecting the TarFile extraction and entry enumeration     APIs. The tar implementation would process tar archives with negative offsets without error, resulting in     an infinite loop and deadlock during the parsing of maliciously crafted tar archives. This vulnerability     can be mitigated by including the following patch after importing the tarfile module:
    https://gist.github.com/sethmlarson/1716ac5b82b73dbcbf23ad2eff8b33e1 (CVE-2025-8194)

  - xsltGetInheritedNsList in libxslt before 1.1.43 has a use-after-free issue related to exclusion of result     prefixes. (CVE-2024-55549)

  - numbers.c in libxslt before 1.1.43 has a use-after-free because, in nested XPath evaluations, an XPath     context node can be modified but never restored. This is related to xsltNumberFormatGetValue,     xsltEvalXPathPredicate, xsltEvalXPathStringNs, and xsltComputeSortResultInternal. (CVE-2025-24855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0)

high Nessus Plugin ID 278723

Version 1.2

Version 1.1

Version 1.2 Dec 17, 2025, 4:56 PM CEA reference Plugin Feed: 202512171656
Version 1.1 Dec 15, 2025, 9:39 PM New Plugin Feed: 202512152139