Listen to this Post
How the mentioned CVE works:
This vulnerability exists within the filesystem traversal logic of OSV-SCALIBR. Specifically, in the fallback path of the directory iterator (fs/diriterate/diriterate.go), the `Next()` method fails to properly handle a `nil` return value from a `ReadDir` system call. When `ReadDir` is called on an empty directory, it can return a nil slice instead of an empty one. The subsequent code attempts to index into this nil slice as if it contained elements, causing an “index out of range” panic. This panic immediately crashes the application, leading to a denial-of-service condition. The issue is triggered during the scanning or traversal of an empty directory.
Platform: OSV-SCALIBR
Version: Not Specified
Vulnerability : Denial-of-Service
Severity: Low
date: 2025-11-20
Prediction: Patch by 2025-12-04
What Undercode Say:
`$ scalibr scan /path/with/empty_dir/`
`panic: runtime error: index out of range [bash] with length 0`
`goroutine 1 [bash]:`
`main.processDirectory(…)`
`fs/diriterate/diriterate.go:Next()`
How Exploit:
Attacker creates empty directories.
Application scans malicious path.
Panic triggers service crash.
Protection from this CVE
Update to patched version.
Input sanitization for paths.
Add nil check in code.
Impact:
Application crash.
Denial-of-Service.
Low availability impact.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
