CVE-2026-44740

3 advisories.

Go/github.com/go-git/go-billy/v5 CVE-2026-44740: medium 6.5

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Action: Upgrade github.com/go-git/go-billy/v5 to 5.9.0 or later.

go get github.com/go-git/go-billy/v5@v5.9.0

introduced	fixed	last affected
0	5.9.0	-

5.9.0

CVE-2026-44740 · published 2026-05-13T15:29:47Z · modified 2026-09-10T03:50:55.263613118Z · JSON

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Action: Upgrade github.com/go-git/go-billy/v6 to 6.0.0-alpha.1 or later.

go get github.com/go-git/go-billy/v6@v6.0.0-alpha.1

introduced	fixed	last affected
0	6.0.0-alpha.1	-

6.0.0-alpha.1

CVE-2026-44740 · published 2026-05-13T15:29:47Z · modified 2026-09-10T03:50:55.263613118Z · JSON

Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy

Action: Upgrade github.com/go-git/go-billy/v5 to 5.9.0 or later.

go get github.com/go-git/go-billy/v5@v5.9.0

introduced	fixed	last affected
0	5.9.0	-

5.9.0

CVE-2026-44740 · published 2026-07-24T18:35:55Z · modified 2026-08-08T21:41:53.435927217Z · JSON