Is CVE-2026-44740 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44740 being exploited in the wild.

How severe is CVE-2026-44740?

Medium severity, with a CVSS score of 6.5, published 1 June 2026.

Which products and versions are affected?

github.com/go-git/go-billy/v5 (Go) < 5.9.0, SEMVER:introduced=0,fixed=5.9.0; github.com/go-git/go-billy/v6 (Go) < 6.0.0-alpha.1, SEMVER:introduced=0,fixed=6.0.0-alpha.1; Go-Git Billy < 5.9.0, < 6.0.0-alpha.1; Go-Git Go-Billy < 5.9.0; and 1 more.

Is there a fix for CVE-2026-44740?

Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44740 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44740?

Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go), Go-Git Billy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44740: go-git go-billy denial of service via improper input handling

Q: Is there a fix for CVE-2026-44740?

Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44740 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44740?

Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go), Go-Git Billy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44740 · Severity: medium · CVSS 6.5 · Published 2026-06-01

The go-billy library, a file system abstraction used by the go-git project, is vulnerable to resource exhaustion. An attacker can provide specially crafted repository data or file structures that cause the system to enter an infinite loop or crash. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to users.

Technologies: Go-Git. Vendors: Go, Go-Git.

Quick answers

Is CVE-2026-44740 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44740 being exploited in the wild.
How severe is CVE-2026-44740?: Medium severity, with a CVSS score of 6.5, published 1 June 2026.
Which products and versions are affected?: github.com/go-git/go-billy/v5 (Go) < 5.9.0, SEMVER:introduced=0,fixed=5.9.0; github.com/go-git/go-billy/v6 (Go) < 6.0.0-alpha.1, SEMVER:introduced=0,fixed=6.0.0-alpha.1; Go-Git Billy < 5.9.0, < 6.0.0-alpha.1; Go-Git Go-Billy < 5.9.0; and 1 more.
Is there a fix for CVE-2026-44740?: Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44740 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44740?: Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go), Go-Git Billy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later
```
go get github.com/go-git/go-billy/v5@v5.9.0
```
github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later
```
go get github.com/go-git/go-billy/v6@v6.0.0-alpha.1
```

Technical details

The go-billy library lacks sufficient validation and safety mechanisms, such as cycle detection and recursion limits, when resolving symbolic links. This vulnerability (CWE-674, CWE-835) allows an attacker with the ability to provide untrusted repository data or filesystem structures to trigger infinite loops, uncontrolled recursion, or panics. The issue is reachable over the network if the library is used to process remote repository data. Exploitation results in excessive resource consumption (CPU/Memory) and service instability. The vulnerability is addressed in versions 5.9.0 and 6.0.0-alpha.1.

Affected products

go-git go-billy < 5.9.0, < 6.0.0-alpha.1

Identifiers

CVE-2026-44740
GHSA-m3xc-h892-ggx6
GO-2026-5490

Timeline

2026-05-11: patched: Fixes released in v5.9.0 and v6.0.0-alpha.1
2026-05-13: advisory: GitHub Advisory published
2026-06-01: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.