CVE-2025-13425: Google Osv-Scalibr

Low severity, CVSS 1.9. EPSS: 0.1% chance of exploitation in the next 30 days.

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

Affected products

• Google Osv-Scalibr: before 0.3.4 (fixed in 0.3.4)

Published 2025-11-20. Last modified 2026-06-17.