GitHub Advisoryadvisory · Go

GHSA-f786-75f3-74xj OSV-SCALIBR has NULL Pointer Dereference

LOW Published 2025-11-20 Modified 2025-11-27 Official page ↗
Aliases
CVE-2025-13425
Ecosystem
Go
Packages
github.com/google/osv-scalibr
Severity
Low
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P
Weaknesses
CWE-476
Reviewed
2025-11-20

Affected packages

• Go github.com/google/osv-scalibr: < 0.3.4 → fixed in 0.3.4

Description

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

Related

Alias · CVE (1)

  • CVE-2025-13425 A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns… vulnerability

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References