CVE-2026-44740: 
Packer vulnerability analysis and mitigation

CVE-2026-44740 is a denial-of-service vulnerability in go-billy, the filesystem abstraction library for Go used by the go-git project. Multiple components fail to properly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption — specifically due to a lack of depth and cycle detection in symlink resolution. Affected versions include github.com/go-git/go-billy/v5 prior to v5.9.0 and github.com/go-git/go-billy/v6 prior to v6.0.0-alpha.1; versions prior to v5 are also likely affected. The vulnerability was reported privately by @faran66, published on May 11, 2026, and assigned a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, go-billy Advisory).

The root cause is insufficient input validation in go-billy's filesystem abstraction components, classified under CWE-674 (Uncontrolled Recursion) and CWE-835 (Loop with Unreachable Exit Condition / Infinite Loop). Specifically, symlink resolution lacks cycle detection and recursion depth limits, meaning a crafted repository containing circular or deeply nested symlinks can cause the library to recurse indefinitely or loop without termination. An attacker with low-level network access (e.g., a user able to push or serve a malicious repository) can trigger these conditions by supplying untrusted repository data or filesystem structures containing adversarial symlink configurations. No public proof-of-concept exploit code has been identified (Github Advisory, go-billy Advisory).

Successful exploitation results in a denial-of-service condition affecting the availability of any application that uses go-billy to process untrusted repository data or filesystem structures. Impacts include application panics (crashes), infinite loops consuming CPU, uncontrolled stack growth from recursion, and excessive memory or resource consumption — all of which can render the affected service unavailable. There is no confidentiality or integrity impact; the vulnerability is purely an availability concern (Github Advisory).

1. Identify a target: Locate an application or service that uses github.com/go-git/go-billy/v5 (< v5.9.0) or github.com/go-git/go-billy/v6 (< v6.0.0-alpha.1) to process repository data from untrusted sources (e.g., a self-hosted Git service, CI/CD pipeline, or code analysis tool).
2. Craft a malicious repository: Create a Git repository containing circular symlinks (e.g., symlink A → B, symlink B → A) or deeply nested symlink chains designed to trigger infinite recursion or loop conditions during filesystem traversal.
3. Submit the malicious repository: Push the crafted repository to the target service, or serve it from an attacker-controlled Git server that the target application clones or fetches from. Low-privilege authenticated access is sufficient.
4. Trigger symlink resolution: Cause the target application to perform a filesystem operation (e.g., open, stat, or traverse) on the malicious repository contents, invoking go-billy's symlink resolution code without cycle detection or recursion limits.
5. Achieve denial of service: The application enters an infinite loop or uncontrolled recursion, consuming CPU and/or memory until it panics, crashes, or becomes unresponsive (Github Advisory, go-billy Advisory).

• Logs: Application logs showing repeated or non-terminating filesystem traversal operations; Go runtime stack overflow or panic messages referencing go-billy symlink resolution functions.
• Process: Abnormally high CPU utilization by the Go application process sustained over time; process memory growing unboundedly without release; application process crashing with a Go panic traceback.
• Network: Unexpected cloning or fetching of external repositories containing unusual symlink structures; connections to unfamiliar Git server endpoints preceding application instability.

Users should upgrade to the patched versions: github.com/go-git/go-billy/v5 v5.9.0 or github.com/go-git/go-billy/v6 v6.0.0-alpha.1. Versions prior to v5 are also likely affected and users are strongly recommended to migrate to a supported version. No configuration-based workaround is documented; upgrading is the only recommended remediation. Applications that process only trusted repository data have a reduced risk profile but should still upgrade (go-billy v5.9.0 Release, go-billy v6.0.0-alpha.1 Release, Github Advisory).

The vulnerability was responsibly disclosed by researcher @faran66 to the go-git project maintainers and patched prior to public disclosure. OpenSUSE issued multiple security announcements addressing this CVE in downstream packages, and Chainguard/Wolfi container images were updated to include the fix. The rclone project also noted the dependency update in its changelog. No significant broader media coverage or notable researcher commentary beyond the advisory has been identified (go-billy Advisory).