NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐹
🐹 Go
Not in CISA KEV
MEDIUM severity

CVE-2026-44740 — go-billy

MEDIUM

CVE-2026-44740 is a medium-severity (CVSS 6.5) CWE-674 vulnerability in github.com/go-git/go-billy/v5. A fix is available for github.com/go-git/go-billy/v5 — see the affected versions and patch details below.

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Also known asGHSA-m3xc-h892-ggx6GO-2026-5490
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Nov 8, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44740.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs33th percentile — riskier than 33% of all scored CVEsHighest risk
0.00%0.34%0.69%1.03%0.3%0.4%Jul 26Oct 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

2 pkgs affected
🐹github.com/go-git/go-billy/v5🐹github.com/go-git/go-billy/v6

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures.

Patches

Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to v5 are likely to be affected, users are recommended to upgrade to a supported go-billy version.

Credits

Thanks to @faran66 for finding and reporting this issue privately to the go-git project. 🙇

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
🐹Gogithub.com/go-git/go-billy/v5all versions5.9.0go get github.com/go-git/go-billy/v5@v5.9.0
🐹Gogithub.com/go-git/go-billy/v6all versions6.0.0-alpha.1go get github.com/go-git/go-billy/v6@v6.0.0-alpha.1

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/go-git/go-billy/v5, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update github.com/go-git/go-billy/v5 to 5.9.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44740 is resolved across your whole dependency graph.

  3. Workarounds

    Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics,…

Workaround published by Red Hat
To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+
Source: Red Hat security advisory for CVE-2026-44740 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Enterprise Linux 8grafana-0:9.2.10-32.el8_10RHSA-2026:46391
RHEM 1.1 for RHEL 10flightctl-0:1.1.4-1.el10emRHSA-2026:68334
RHEM 1.2 for RHEL 10flightctl-0:1.2.1-1.el10RHSA-2026:68335
Cluster Observability Operator 1.5cluster-observability-operator/perses-rhel9:1787593946RHSA-2026:61314
external secrets operator for Red Hat OpenShift 1.1external-secrets-operator/external-secrets-rhel9:1786614676RHSA-2026:54525
multicluster engine for Kubernetes 2.10multicluster-engine/cluster-image-set-controller-rhel9:1784646026RHSA-2026:46885
multicluster engine for Kubernetes 2.10multicluster-engine/cluster-image-set-controller-rhel9:1784646026RHSA-2026:47388
multicluster engine for Kubernetes 2.11multicluster-engine/cluster-image-set-controller-rhel9:1786911957RHSA-2026:57194

Frequently Asked Questions

### Impact Multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. ### Patches Users should upgrade to a patched version in order to mitigate this vulnerability. Versions prior to `v5` are likely to be affected, users are recommended to upgrade to a suppo
O3 Security · Impact-Aware SCA

Is CVE-2026-44740 in your dependencies?

Find it across Go, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-44740: go-billy — Fixed in 5.9.0