{"id":"GO-2026-6113","revision":"22a6ce125ffc4e0289a385ae08c10d4a","records":[{"revision":"22a6ce125ffc4e0289a385ae08c10d4a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6113","aliases":["CVE-2026-102663","GHSA-p6ph-3jx2-3337"],"title":"OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList","description":"OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-10-13T10:55:40.368699+00:00","affected":[{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/OpenListTeam/OpenList/v4","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.2.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337","https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a","https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679","https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6113","license":"OSV · upstream source license applies","key":"osv:GO-2026-6113","identifiers":["GO-2026-6113","CVE-2026-102663","GHSA-p6ph-3jx2-3337"]},"retained":false,"historicalAffected":[]}],"coverage":[]}