What’s Vulnerable › Vulnerabilities
CVE-2025-13425: Denial of Service in OSV-SCALIBR
- Severity: low (CVSS 1.9 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-11-20 · updated 2026-10-18
- Weakness: CWE-476
Description
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
Affected products
- Google OSV-SCALIBR: before 0.3.4
References
Get alerted when CVE-2025-13425 or the next vulnerability affects your stack