CVE-2025-13425
published 2025-11-20CVE-2025-13425: A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty…
PriorityP47low1.9CVSS 4.0
AVLACLATNPRLUINVCNVINVALSCNSINSALEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.11%
1.3th percentile
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | google_osv-scalibr | >= 0 < 0.3.4 | 0.3.4 |
| osv-scalibr | < 0.3.4 | 0.3.4 |
CVSS provenance
nvdv4.01.9LOWCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat1.9LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr
osv·2025-11-25
CVE-2025-13425 OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr
OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr
OSV-SCALIBR has NULL Pointer Dereference in github.com/google/osv-scalibr
OSV
OSV-SCALIBR has NULL Pointer Dereference
osv·2025-11-20
CVE-2025-13425 [LOW] OSV-SCALIBR has NULL Pointer Dereference
OSV-SCALIBR has NULL Pointer Dereference
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
GHSA
OSV-SCALIBR has NULL Pointer Dereference
ghsa·2025-11-20
CVE-2025-13425 [LOW] CWE-476 OSV-SCALIBR has NULL Pointer Dereference
OSV-SCALIBR has NULL Pointer Dereference
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
Red Hat
github.com/google/osv-scalibr: Denial of Service in OSV-SCALIBR
vendor_redhat·2025-11-20·CVSS 1.9
CVE-2025-13425 [LOW] CWE-476 github.com/google/osv-scalibr: Denial of Service in OSV-SCALIBR
github.com/google/osv-scalibr: Denial of Service in OSV-SCALIBR
A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.
A denial of service flaw has been discovered in the osv-scalibr library. A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service).
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Securi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-20
Published