CVE-2026-44740

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44740
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44740.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-44740
Aliases
Downstream
Related
Published
2026-06-01T16:04:50.358Z
Modified
2026-06-09T18:29:26.982524847Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion
Details

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44740.json",
    "cwe_ids": [
        "CWE-674",
        "CWE-835"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/go-git/go-billy

Affected ranges

Type
GIT
Repo
https://github.com/go-git/go-billy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
13ded9edf4ef0b9f317ad3b432fbd43045754d27

Affected versions

Other
v1-alpha
v1.*
v1.0.0
v2.*
v2.0.0
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v3.*
v3.0.0
v3.0.1
v3.1.0
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.3.2
v5.*
v5.0.0
v5.1.0
v5.2.0
v5.3.0
v5.3.1
v5.4.0
v5.4.1
v5.5.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-44740.json"