Threats tagged 'ghsa-96wc-2m84-2cj7'

isomorphic-git versions prior to 1.38.6 are vulnerable to a denial of service caused by circular symbolic references. A malicious server can advertise symrefs that reference each other in a loop, which are then written to disk by the client. The GitRefManager.resolve() method does not detect cycles or enforce a default depth limit, causing operations that resolve these refs (e.g., log, status, checkout) to hang indefinitely. This results in a persistent denial of service, rendering the repository unusable until fixed.