CVE-2026-44740 Overview
CVE-2026-44740 affects go-billy, an interface filesystem abstraction library for Go widely used by go-git and related tooling. Multiple components in the library mishandle crafted or malformed input. Attackers supplying untrusted repository data or filesystem structures can trigger panics, infinite loops, uncontrolled recursion, or excessive resource consumption. The root cause is insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, and defensive handling of unexpected states. The flaw is tracked under [CWE-674: Uncontrolled Recursion]. Maintainers patched the issue in v5.9.0 and v6.0.0-alpha.1.
Critical Impact
A low-privileged remote attacker can cause denial of service in any Go application that processes attacker-controlled repositories or filesystem inputs through go-billy.
Affected Products
- github.com/go-git/go-billy prior to v5.9.0
- github.com/go-git/go-billyv6.0.0 pre-release versions prior to v6.0.0-alpha.1
- Downstream consumers including applications built on go-git that pass untrusted repository data through go-billy filesystem abstractions
Discovery Timeline
- 2026-06-01 - CVE-2026-44740 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-44740
Vulnerability Analysis
The go-billy library exposes an abstraction layer used to model in-memory, on-disk, and chrooted filesystems. Several components walk filesystem structures or parse repository metadata without bounding recursion depth, detecting cycles, or validating structural invariants. When supplied with crafted input, these code paths reach unexpected states and either panic, enter infinite loops, or allocate resources without bound. Because go-billy is consumed by go-git, the vulnerability propagates to any service that clones, inspects, or otherwise processes untrusted Git repositories using the pure-Go stack. The result is availability loss for the host process, which in long-running services translates to denial of service across all tenants sharing that process.
Root Cause
The library lacks defensive checks across multiple components. Specifically, recursive traversal routines do not enforce depth limits, symlink and directory walking lacks cycle detection, and parsers do not validate malformed states before continuing. These omissions allow attacker-controlled structures to drive the code into pathological execution paths classified under [CWE-674].
Attack Vector
An attacker with low privileges on the network supplies a malformed repository, packfile, or filesystem structure to an application that processes it through go-billy. Exploitation requires no user interaction. The attacker does not gain confidentiality or integrity impact, but the targeted process halts, panics, or exhausts CPU and memory. The vulnerability manifests in recursive traversal and parsing routines. See the GitHub Security Advisory GHSA-m3xc-h892-ggx6 for component-level technical details.
Detection Methods for CVE-2026-44740
Indicators of Compromise
- Unexpected Go runtime panics or runtime: goroutine stack exceeds errors in services that use go-git or go-billy
- Sudden CPU saturation or memory growth in a worker process immediately after ingesting a remote repository or archive
- Process crashes correlated with requests carrying user-supplied Git URLs, packfiles, or filesystem payloads
Detection Strategies
- Inventory Go binaries with go version -m <binary> and flag any that embed github.com/go-git/go-billy versions earlier than v5.9.0 or v6.0.0-alpha.1
- Scan source repositories and go.sum files for vulnerable module versions using software composition analysis
- Add application-layer logging around repository ingestion to capture input size, source identity, and processing duration
Monitoring Recommendations
- Alert on repeated panics or restarts of services that parse external Git data
- Track per-request CPU time and memory for endpoints accepting repository URLs and trigger on outliers
- Correlate denial-of-service symptoms with the originating tenant or API key to identify abuse patterns
How to Mitigate CVE-2026-44740
Immediate Actions Required
- Upgrade github.com/go-git/go-billy to v5.9.0 for the v5.x line or v6.0.0-alpha.1 for the v6.x line
- Rebuild and redeploy all Go binaries that depend on the library, directly or transitively through go-git
- Restrict which users or tenants can submit arbitrary repository URLs or filesystem payloads until patches are deployed
Patch Information
The maintainers released fixes in go-billy v5.9.0 and go-billy v6.0.0-alpha.1. Both releases add the missing validation, recursion limits, and cycle detection in the affected components. Consumers should update go.mod to pin a fixed version and run go mod tidy followed by a full rebuild.
Workarounds
- Process untrusted repositories inside isolated worker processes with strict CPU, memory, and timeout limits enforced by cgroups or container runtimes
- Reject oversized or structurally suspicious inputs at an ingress proxy before they reach Go services
- Disable features that clone or parse arbitrary user-supplied repositories until the dependency is upgraded
# Update go-billy to a patched version
go get github.com/go-git/go-billy/v5@v5.9.0
go mod tidy
go build ./...
# Verify the resolved version
go list -m github.com/go-git/go-billy/v5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
