CVE-2026-44740: go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion
Impact Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.
These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.
Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.
Credits Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇
Other sources
Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/github.com/go-git/go-billy/v6to a version that resolves this vulnerability.Fixed in 6.0.0-alpha.1 - Upgrade
Upgrade
go/github.com/go-git/go-billy/v5to a version that resolves this vulnerability.Fixed in 5.9.0 - Upgrade
Upgrade
go-billyto a version that resolves this vulnerability.Fixed in 5.9.0 - Upgrade
Upgrade
go-billyto a version that resolves this vulnerability.Fixed in 6.0.0-alpha.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44740?
CVE-2026-44740 can lead to critical issues like panics, infinite loops, and excessive resource consumption due to improper handling of crafted input.
How do I fix CVE-2026-44740?
To fix CVE-2026-44740, upgrade to version 6.0.0-alpha.1 for go-git/go-billy/v6 or version 5.9.0 for go-git/go-billy/v5.
What components are affected by CVE-2026-44740?
CVE-2026-44740 affects the go-git/go-billy packages, specifically versions below 5.9.0 and 6.0.0-alpha.1.
What kind of vulnerabilities does CVE-2026-44740 involve?
CVE-2026-44740 involves vulnerabilities that allow for improper handling of input, potentially resulting in uncontrolled recursion and performance degradation.
Is there a risk of exploitation with CVE-2026-44740?
Yes, the vulnerabilities outlined in CVE-2026-44740 pose a risk of exploitation through crafted input, leading to significant system strain or crashes.