CVE-2025-13425: OSV-SCALIBR has NULL Pointer Dereference

November 20, 2025 (updated November 27, 2025)

A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty directory, resulting in a panic (index out of range) and an application crash (denial of service) in OSV-SCALIBR.

References

github.com/advisories/GHSA-f786-75f3-74xj
github.com/google/osv-scalibr
github.com/google/osv-scalibr/commit/e67c4e198ca099cb7c16957a80f6c5331d90a672
nvd.nist.gov/vuln/detail/CVE-2025-13425

Code Behaviors & Features

Detect and mitigate CVE-2025-13425 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →