CVE-2025-13425 LOW

CVE-2025-13425: Denial of Service in OSV-SCALIBR

Vendor Google
Product OSV-SCALIBR
Weakness CWE-476
Published November 20, 2025
Last update November 20, 2025
View on NVD All CVEs

CVSS base score

1.9/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:P

What the vulnerability does

01Description

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

Key dates

02Disclosure timeline

November 20, 2025 CVE published
November 20, 2025 Record updated