Affected Products

Timeline

• Jan 28, 2025 CVE Published
• Feb 4, 2026 CVE Updated
• May 1, 2026 Security Advisory

References

• https://github.com/advisories/GHSA-wpfp-cm49-9m9q advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0377 advisory
• https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack url