CVE-2026-63475mediumCWE-674CWE-835

CVE-2026-63475: falha de média gravidade em isomorphic-git

isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)

Publicada em

Seguir esta CVE+ Monitorar isomorphic-git

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.4%
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Produtos afetados
isomorphic-git · isomorphic-git
CVEs relacionadas — isomorphic-git

No mesmo produto, das mais perigosas para as menos.

CVE-2026-63395HIGHisomorphic-git: Arbitrary file write outside the working tree via a directory symlink during checkout (potential RCE)EPSS 0.7%CVE-2026-89011HIGHisomorphic-git < 1.42.0 Prototype Pollution via getRemoteInfoEPSS 0.4%CVE-2026-63478MEDIUMisomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkoutEPSS 0.3%CVE-2026-63476MEDIUMisomorphic-git: Unbounded memory allocation from attacker-controlled delta target size (DoS)EPSS 0.3%