CVE-2026-44740 go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion
Attackers can cause infinite loops and resource exhaustion in go-billy via crafted symlink structures, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44740?
CVE-2026-44740 is a medium-severity denial of service vulnerability in go-git go-billy, published on 1 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
Which versions are affected by CVE-2026-44740?
5 open source packages ship an affected version, including github.com/go-git/go-billy/v5 and github.com/go-git/go-billy/v6.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-git/go-billy/v5 Go | All versions | 5.9.0 |
github.com/go-git/go-billy/v5 Go | All versions | 5.9.0 |
github.com/go-git/go-billy/v5 Go | All versions | 5.9.0 |
github.com/go-git/go-billy/v6 Go | All versions | 6.0.0-alpha.1 |
github.com/go-git/go-billy/v6 Go | All versions | 6.0.0-alpha.1 |
Linux distribution packages (9)
grafana AlmaLinux:8 | All versions | 9.2.10-32.el8_10 |
grafana-selinux AlmaLinux:8 | All versions | 9.2.10-32.el8_10 |
grafana Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-32.el8_10 |
grafana-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-32.el8_10 |
grafana-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-32.el8_10 |
grafana-selinux Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-32.el8_10 |
grafana Rocky Linux:8 | All versions | 0:9.2.10-32.el8_10 |
amazon-ssm-agent openSUSE:Tumbleweed | All versions | 3.3.4624.0-1.1 |
git-bug openSUSE:Tumbleweed | All versions | 0.10.1-6.1 |
How do I fix CVE-2026-44740?
Upgrade github.com/go-git/go-billy/v5 to 5.9.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-44740 being exploited?
There is no known exploitation of CVE-2026-44740 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:46391, CLEANSTART-2026-BS27714, CLEANSTART-2026-ZI20918, DEBIAN-CVE-2026-44740, GHSA-m3xc-h892-ggx6, GO-2026-5490 and 177 more.