VYPR
Low severityOSV Advisory· Published Nov 20, 2025· Updated Apr 15, 2026

CVE-2025-13425

CVE-2025-13425

Description

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/google/osv-scalibrGo
< 0.3.40.3.4

Affected products

1

Patches

1
e67c4e198ca0

Fix array overindexing bug in diriterate when using the fallback method on empty dirs.

https://github.com/google/osv-scalibrErik VargaSep 10, 2025via ghsa
1 file changed · +6 1
  • fs/diriterate/diriterate.go+6 1 modified
    @@ -63,14 +63,19 @@ type DirIterator struct {
     // Next returns the next fs.DirEntry from the directory. If error is nil, there will be a
     // fs.DirEntry returned.
     func (i *DirIterator) Next() (fs.DirEntry, error) {
    -	if i.files != nil {
    +	if len(i.files) > 0 {
     		if i.curr >= len(i.files) {
     			return nil, io.EOF
     		}
     		i.curr++
     		return i.files[i.curr-1], nil
     	}
     
    +	if i.dir == nil {
    +		// This is an iterator for an empty directory, so we return EOF immediately.
    +		return nil, io.EOF
    +	}
    +
     	list, err := i.dir.ReadDir(1)
     	if err != nil {
     		return nil, err
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

3

News mentions

0

No linked articles in our index yet.