{"id":"GO-2026-6113","aliases":["GHSA-p6ph-3jx2-3337"],"title":"OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList","summary":"OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList","severity":"none","vendor":"OpenListTeam","product":"github.com/OpenListTeam/OpenList","ecosystem":"go","affected":["github.com/OpenListTeam/OpenList","github.com/OpenListTeam/OpenList/v3","github.com/OpenListTeam/OpenList/v4 < 4.2.4"],"patched":["github.com/OpenListTeam/OpenList/v4 4.2.4"],"published":"2026-08-18","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GO-2026-6113","references":[{"url":"https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-p6ph-3jx2-3337"},{"url":"https://github.com/OpenListTeam/OpenList/commit/59bd3431408578f420895457554700cc9a52375a"},{"url":"https://github.com/OpenListTeam/OpenList/commit/84ecda35aae2bd0020474086e6ddfd3aa2340679"},{"url":"https://github.com/OpenListTeam/OpenList/releases/tag/v4.2.4"}],"tags":["osv","go"],"ingestedAt":"2026-08-18T19:21:37.861Z","slug":"GO-2026-6113","body":"## Overview\n\nOpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList\n\n## Affected packages\n\n- `github.com/OpenListTeam/OpenList`\n- `github.com/OpenListTeam/OpenList/v3`\n- `github.com/OpenListTeam/OpenList/v4 < 4.2.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/OpenListTeam/OpenList/v4 4.2.4`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}