https://amey-thakur.github.io/tags/osv-scanner/Recent content in OSV-Scanner on AmeyArcHugo -- 0.152.2en-usWed, 02 Sep 2026 22:41:48 -0400https://amey-thakur.github.io/posts/2026-09-02-a-stack-overflow-denial-of-service-in-googles-osv-scanner/Wed, 02 Sep 2026 22:41:48 -0400https://amey-thakur.github.io/posts/2026-09-02-a-stack-overflow-denial-of-service-in-googles-osv-scanner/OSV-Scanner reads the licence text of every package it scans, and it parsed that text with a recursive descent that had no depth limit. Roughly three megabytes of open brackets exhausted the goroutine stack. In Go a stack overflow is a fatal error rather than a panic, so recover cannot catch it and one malformed package ended the entire scan. This is the report, the forty lines that fixed it, and what contributing upstream to Google actually involved.