CVE-2025-13425CWE-476

CVE-2025-13425

published November 20, 2025

CVSS
1.9
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

The record
Technical detail
CVSS
1.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00111 · 1.3th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2025-11-20T21:15Z
References (1)
https://github.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672 · [email protected]
EPSS history
Timeline
  • 20 NOV 15:30Z
    Denial of Service in OSV-SCALIBR
    cvelistv5