CVE-2026-44740High· 7.5▾ Twilight

github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation (CVE-2026-44740)

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score41/ 100 · Moderate

impact 41.3 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jun 1, 2026

Updated

Sep 21, 2026

CVSS

7.5

Vendor

Red Hat

Product

Red Hat Openshift Data Foundation 4.22

CWE

CWE-606

Depth score

41 · Moderate

EPSS

0.39% · p33

Platforms

—

Source

CSAF

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS history

Exploit-prediction probability, daily snapshots since Jul 25.

0.3% → 0.4%▲ 0.09%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

10 events · 112 days

Jun 1, 2026Published
Disclosed via CSAF
Jul 25, 2026EPSS first tracked
0.3%
Aug 24, 2026EPSS peak
0.3% → 0.4%
Sep 8, 2026CVSS changed
6.5 → 7.5
Sep 8, 2026Severity changed
medium → high
Sep 8, 2026CVSS changed
7.5 → 6.5
Sep 8, 2026Severity changed
high → medium
Sep 8, 2026CVSS changed
6.5 → 7.5
Sep 8, 2026Severity changed
medium → high
Sep 21, 2026Record revised
Last analysed / modified upstream

Red Hat CWE-606 #csaf #vex #red-hat #osv #go

Affected

Patched in

rhem_1_1_for_rhel 10
rhem_1_2_for_rhel 10
rhem_1_1_for_rhel 9
rhem_1_2_for_rhel 9
enterprise_linux_appstream_v_8
cluster_observability_operator 1.5.0
openshift_api_for_data_protection 1.3
openshift_api_for_data_protection 1.4
openshift_api_for_data_protection 1.5
advanced_cluster_management_for_kubernetes 2.11
advanced_cluster_management_for_kubernetes 2.13
advanced_cluster_management_for_kubernetes 2.14
advanced_cluster_management_for_kubernetes 2.15
advanced_cluster_management_for_kubernetes 2.16
advanced_cluster_management_for_kubernetes 2.17
edge_manager 1.1
edge_manager 1.2
hardened_images
openshift_gitops 1.21
openshift_data_foundation 4.19
openshift_data_foundation 4.20
openshift_data_foundation 4.22
trusted_artifact_signer 1.3
trusted_artifact_signer 1.4
external_secrets_operator_for_red_hat_openshift 1.1
multicluster_engine_for_kubernetes 2.11
multicluster_engine_for_kubernetes 2.17
multicluster_engine_for_kubernetes 2.1
multicluster_engine_for_kubernetes 2.8
multicluster_engine_for_kubernetes 2.9

Full technical detail▾

Overview

A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

Vendor advisories

RHSA-2026:68334 · Red Hat · fixed in: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:68335 · Red Hat · fixed in: RHEM 1.2 for RHEL 10, RHEM 1.2 for RHEL 9 · released 2026-09-16 · advisory
RHSA-2026:46391 · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-07-27 · advisory
RHSA-2026:61314 · Red Hat · fixed in: Cluster Observability Operator 1.5.0 · released 2026-08-31 · advisory
RHSA-2026:51033 · Red Hat · fixed in: OpenShift API for Data Protection 1.3 · released 2026-08-06 · advisory
RHSA-2026:59467 · Red Hat · fixed in: OpenShift API for Data Protection 1.4 · released 2026-08-25 · advisory
RHSA-2026:66022 · Red Hat · fixed in: OpenShift API for Data Protection 1.5 · released 2026-09-09 · advisory
RHSA-2026:60387 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · advisory
RHSA-2026:47737 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-07-29 · advisory
RHSA-2026:36873 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-07-08 · advisory
RHSA-2026:60388 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · advisory
Red Hat VEX · Important · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, Confidential Compute Attestation, Exploit Intelligence, External Secrets Operator for Red Hat OpenShift, Kernel Module Management Operator for Red Hat Openshift, … · no fix planned: Confidential Compute Attestation, External Secrets Operator for Red Hat OpenShift, Migration Toolkit for Virtualization, Multicluster Engine for Kubernetes, … · updated 2026-09-21 · vex
RHSA-2026:54427 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-08-12 · advisory
RHSA-2026:46903 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.15 · released 2026-07-27 · advisory
RHSA-2026:57191 · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.16 · released 2026-08-19 · advisory

github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation — rated Important by Red Hat. Released 2026-06-01, updated 2026-09-21.

Affected:

Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
Confidential Compute Attestation
Exploit Intelligence
External Secrets Operator for Red Hat OpenShift
Kernel Module Management Operator for Red Hat Openshift
Machine Deletion Remediation Operator
Migration Toolkit for Virtualization
Multicluster Engine for Kubernetes
Node HealthCheck Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
OpenShift Service Mesh 2
Power monitoring for Red Hat OpenShift
Red Hat Advanced Cluster Security 4
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Ceph Storage 9
Red Hat Developer Hub
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenShift GitOps
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1
Red Hat Trusted Artifact Signer
Red Hat Web Terminal

Fixed:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Red Hat Enterprise Linux AppStream (v. 8)
Cluster Observability Operator 1.5.0
OpenShift API for Data Protection 1.3
OpenShift API for Data Protection 1.4
OpenShift API for Data Protection 1.5
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13
Red Hat Advanced Cluster Management for Kubernetes 2.14
Red Hat Advanced Cluster Management for Kubernetes 2.15
Red Hat Advanced Cluster Management for Kubernetes 2.16
Red Hat Advanced Cluster Management for Kubernetes 2.17
Red Hat Edge Manager 1.1
Red Hat Edge Manager 1.2
Red Hat Hardened Images
Red Hat OpenShift GitOps 1.21
Red Hat Openshift Data Foundation 4.19
Red Hat Openshift Data Foundation 4.20
Red Hat Openshift Data Foundation 4.22
Red Hat Trusted Artifact Signer 1.3
Red Hat Trusted Artifact Signer 1.4
external secrets operator for Red Hat OpenShift 1.1
multicluster engine for Kubernetes 2.11
multicluster engine for Kubernetes 2.17
multicluster engine for Kubernetes 2.1
multicluster engine for Kubernetes 2.8
multicluster engine for Kubernetes 2.9

No fix planned:

Confidential Compute Attestation
External Secrets Operator for Red Hat OpenShift
Migration Toolkit for Virtualization
Multicluster Engine for Kubernetes
OpenShift Service Mesh 2
Red Hat AI Inference Server
Red Hat Ansible Automation Platform 2
Red Hat Developer Hub
Red Hat OpenShift AI (RHOAI)
Red Hat OpenShift Container Platform 4
Red Hat OpenShift GitOps
Assisted Installer for Red Hat OpenShift Container Platform 2
Builds for Red Hat OpenShift
Exploit Intelligence
Kernel Module Management Operator for Red Hat Openshift
Machine Deletion Remediation Operator
Node HealthCheck Operator
OpenShift Developer Tools and Services
OpenShift Lightspeed
OpenShift Pipelines
OpenShift Serverless
Power monitoring for Red Hat OpenShift
Red Hat Advanced Cluster Security 4
Red Hat Ceph Storage 9
Red Hat OpenShift Dev Spaces
Red Hat OpenShift Dev Workspaces Operator
Red Hat OpenStack Platform 16.2
Red Hat OpenStack Platform 17.1
Red Hat Trusted Artifact Signer
Red Hat Web Terminal

Not affected:

RHEM 1.1 for RHEL 10
RHEM 1.2 for RHEL 10
RHEM 1.1 for RHEL 9
RHEM 1.2 for RHEL 9
Cluster Observability Operator 1.5.0
OpenShift API for Data Protection 1.3
OpenShift API for Data Protection 1.4
OpenShift API for Data Protection 1.5
Red Hat Advanced Cluster Management for Kubernetes 2.11
Red Hat Advanced Cluster Management for Kubernetes 2.13

Remediation

See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.1 https://access.redhat.com/errata/RHSA-2026:68334 See the following documentation for details on how to enable Red Hat Edge Manager and more: https://docs.redhat.com/en/documentation/red_hat_edge_manager/1.2 https://access.redhat.com/errata/RHSA-2026:68335 For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:46391

Workarounds / mitigations:

To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+

Package advisory (CVE-2026-44740)

Affected packages:

github.com/go-git/go-billy/v5 < 5.9.0
github.com/go-git/go-billy/v6 < 6.0.0-alpha.1

Patched in:

github.com/go-git/go-billy/v5 5.9.0
github.com/go-git/go-billy/v6 6.0.0-alpha.1

Source: https://osv.dev/vulnerability/GHSA-m3xc-h892-ggx6

References

Change history

Field changes observed since this record was first indexed.

Sep 8, 2026CVSS 6.5 → 7.5
Sep 8, 2026Severity medium → high
Sep 8, 2026CVSS 7.5 → 6.5
Sep 8, 2026Severity high → medium
Sep 8, 2026CVSS 6.5 → 7.5
Sep 8, 2026Severity medium → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#csaf#vex#red-hat#osv#go

← Back to feed