{"id":"CVE-2026-63475","aliases":["GHSA-96wc-2m84-2cj7"],"url":"https://o3.security/vulnerability/CVE-2026-63475","summary":"isomorphic-git: Circular symbolic references cause non-terminating resolution (DoS)","details":"### Summary\nA malicious server can advertise circular `symref=` capabilities (e.g. `a → b` and `b → a`). isomorphic-git writes them to disk as loose symrefs, and `GitRefManager.resolve()` follows them with no depth limit and no cycle detection, so any later operation that resolves one of them (`log`, `status`, `checkout`, `branch`, …) **loops forever** — a persistent denial of service from a single clone.\n\n### Details\n`src/managers/GitRefManager.js` — `resolve()` only enforces a depth limit when a `depth` argument is passed (`depth = undefined` by default), and has no visited-set:\n\n```js\nstatic async resolve({ fs, gitdir, ref, depth = undefined }) {\n  if (depth !== undefined) { depth--; if (depth === -1) return ref }\n  …\n}\n```\n\n`updateRemoteRefs` persists all server-supplied symrefs unconditionally. After clone the client has `refs/remotes/origin/a → ref: refs/remotes/origin/b` and `b → a` on disk; resolving either never terminates. Because the bad refs live on disk, the repo is effectively bricked for the application.\n\n#### Canonical git behavior (divergence)\ngit caps symref resolution at `SYMREF_MAXDEPTH = 5` (refs.c): `git rev-parse a` returns immediately with `warning: ignoring dangling symref` — no recursion, no hang.\n\n### PoC\n`https://github.com/spiceoverflow/av5-circular-symref` — open in a Codespace; clone writes the circular symrefs, then `git.log` on one never returns (the runner stops it after a 20s hang):\n\n```\n[AV-5] refs/remotes/origin/a contains: ref: refs/remotes/origin/b\n[AV-5] refs/remotes/origin/b contains: ref: refs/remotes/origin/a\n[run] *** DoS CONFIRMED: resolving a circular symref never terminates ***\n```\n\n### Impact\nA persistent denial of service via non-terminating symbolic-ref resolution (CWE-674 / CWE-835). After a single clone from a malicious (or MitM'd) server the circular refs are written to disk, so every later operation that resolves them (`log`, `status`, `checkout`, `branch`, …) hangs forever — the repository becomes effectively unusable for the application.\n\nImpacted: any application that clones from untrusted/compromised remotes with isomorphic-git.\n\n### Suggested fix\nAdd visited-set cycle detection (and/or a default maximum depth, as git does) in `GitRefManager.resolve()`; optionally validate server-supplied symref targets before persisting.","published":"2026-11-03T19:45:24.488Z","modified":"2026-11-05T03:30:19.670102188Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"isomorphic-git","fixedVersion":"1.38.6"}],"fix":{"url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b","label":"isomorphic-git/isomorphic-git@823843d"},"references":[{"type":"WEB","url":"https://github.com/isomorphic-git/isomorphic-git/releases/tag/v1.38.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63475.json"},{"type":"ADVISORY","url":"https://github.com/isomorphic-git/isomorphic-git/security/advisories/GHSA-96wc-2m84-2cj7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63475"},{"type":"FIX","url":"https://github.com/isomorphic-git/isomorphic-git/commit/823843d1cd19182df79bc907c767f5bcecb39a0b"},{"type":"FIX","url":"https://github.com/isomorphic-git/isomorphic-git/pull/2370"},{"type":"PACKAGE","url":"https://github.com/isomorphic-git/isomorphic-git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-05T03:30:19.670102188Z"}}