Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| isomorphic-git | isomorphic-git | affected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Tue, 03 Nov 2026 20:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6. | |
| Title | isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS) | |
| Weaknesses | CWE-674 CWE-835 |
|
| References |
|
|
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-03T21:31:07.998Z
Reserved: 2026-07-16T21:37:45.769Z
Link: CVE-2026-63475
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-11-03T20:18:15.903
Modified: 2026-11-03T20:18:16.027
Link: CVE-2026-63475
Redhat
No data.
OpenCVE Enrichment
No data.