go-git github.com/go-git/go-billy/v5 vulnerabilities

Latest go-git github.com/go-git/go-billy/v5 CVEs

Newest publication first

1. CVE-2026-44740 go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

   Published 2026-06-01

   Medium·CVSS 6.5 EPSS 0.39%

   Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise...

2. CVE-2026-44973 Billy: Path traversal vulnerabilities

   Published 2026-05-28

   High·CVSS 8.1 EPSS 0.31%

   Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths (e.g., using ..) to escape intended base directories....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.