Executive brief
The go-billy library, a file system abstraction used by the go-git project, is vulnerable to resource exhaustion. An attacker can provide specially crafted repository data or file structures that cause the system to enter an infinite loop or crash. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to users.
Technical details
The go-billy library lacks sufficient validation and safety mechanisms, such as cycle detection and recursion limits, when resolving symbolic links. This vulnerability (CWE-674, CWE-835) allows an attacker with the ability to provide untrusted repository data or filesystem structures to trigger infinite loops, uncontrolled recursion, or panics. The issue is reachable over the network if the library is used to process remote repository data. Exploitation results in excessive resource consumption (CPU/Memory) and service instability. The vulnerability is addressed in versions 5.9.0 and 6.0.0-alpha.1.
Affected products
- go-git go-billy < 5.9.0, < 6.0.0-alpha.1
Timeline
- 2026-05-11: patched: Fixes released in v5.9.0 and v6.0.0-alpha.1
- 2026-05-13: advisory: GitHub Advisory published
- 2026-06-01: disclosed: NVD publication date