# CVE-2026-44740: go-git go-billy denial of service via improper input handling

Source: https://junglewise.ai/threats/cve-2026-44740-go-git-go-billy-denial-of-service-via-improper-input-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44740 · Severity: medium · CVSS 6.5 · Published 2026-06-01

The go-billy library, a file system abstraction used by the go-git project, is vulnerable to resource exhaustion. An attacker can provide specially crafted repository data or file structures that cause the system to enter an infinite loop or crash. This can lead to a denial-of-service (DoS) condition, making the affected service unavailable to users.

Technologies: [Go-Git](https://junglewise.ai/threats/technologies/go-git). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Go-Git](https://junglewise.ai/threats/vendors/go-git).

## Quick answers

**Is CVE-2026-44740 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44740 being exploited in the wild.

**How severe is CVE-2026-44740?** Medium severity, with a CVSS score of 6.5, published 1 June 2026.

**Which products and versions are affected?** github.com/go-git/go-billy/v5 (Go) < 5.9.0, SEMVER:introduced=0,fixed=5.9.0; github.com/go-git/go-billy/v6 (Go) < 6.0.0-alpha.1, SEMVER:introduced=0,fixed=6.0.0-alpha.1; Go-Git Billy < 5.9.0, < 6.0.0-alpha.1; Go-Git Go-Billy < 5.9.0; and 1 more.

**Is there a fix for CVE-2026-44740?** Yes. github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later; github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44740 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44740?** Check whether you run github.com/go-git/go-billy/v5 (Go), github.com/go-git/go-billy/v6 (Go), Go-Git Billy or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/go-git/go-billy/v5 (Go): upgrade to 5.9.0 or later

  ```sh
  go get github.com/go-git/go-billy/v5@v5.9.0
  ```

- github.com/go-git/go-billy/v6 (Go): upgrade to 6.0.0-alpha.1 or later

  ```sh
  go get github.com/go-git/go-billy/v6@v6.0.0-alpha.1
  ```


## Technical details

The go-billy library lacks sufficient validation and safety mechanisms, such as cycle detection and recursion limits, when resolving symbolic links. This vulnerability (CWE-674, CWE-835) allows an attacker with the ability to provide untrusted repository data or filesystem structures to trigger infinite loops, uncontrolled recursion, or panics. The issue is reachable over the network if the library is used to process remote repository data. Exploitation results in excessive resource consumption (CPU/Memory) and service instability. The vulnerability is addressed in versions 5.9.0 and 6.0.0-alpha.1.

## Affected products

- go-git go-billy < 5.9.0, < 6.0.0-alpha.1

## Identifiers

- CVE-2026-44740
- GHSA-m3xc-h892-ggx6
- GO-2026-5490

## Timeline

- 2026-05-11: patched: Fixes released in v5.9.0 and v6.0.0-alpha.1
- 2026-05-13: advisory: GitHub Advisory published
- 2026-06-01: disclosed: NVD publication date

## References

- [https://api.github.com/users/faran66](https://api.github.com/users/faran66)
- [https://github.com/faran66](https://github.com/faran66)
- [https://api.github.com/users/faran66/gists%7B/gist_id%7D](https://api.github.com/users/faran66/gists%7B/gist_id%7D)
- [https://api.github.com/users/faran66/repos](https://api.github.com/users/faran66/repos)
- [https://avatars.githubusercontent.com/u/71405717?v=4](https://avatars.githubusercontent.com/u/71405717?v=4)
- [https://api.github.com/users/faran66/events%7B/privacy%7D](https://api.github.com/users/faran66/events%7B/privacy%7D)

## Related threats

- [go-git path traversal via malicious reference names](https://junglewise.ai/threats/cve-2026-71557-go-git-path-traversal-via-malicious-reference-names)
- [go-git symlink traversal in worktree operations](https://junglewise.ai/threats/cve-2026-71556-go-git-symlink-traversal-in-worktree-operations)
- [go-git DoS via malformed Git object data](https://junglewise.ai/threats/go-git-dos-via-malformed-git-object-data-a3075e9b)
- [go-git go-billy path traversal in multiple components](https://junglewise.ai/threats/cve-2026-44973-go-git-go-billy-path-traversal-in-multiple-components)
- [go-git path traversal via crafted repository data](https://junglewise.ai/threats/cve-2026-45571-go-git-path-traversal-via-crafted-repository-data)