Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-git/go-billy/v5 | go | < 5.9.0 | 5.9.0 |
| github.com/go-git/go-billy/v6 | go | < 6.0.0-alpha.1 | 6.0.0-alpha.1 |
Miggo AIRoot Cause AnalysisThe vulnerability in go-billy stems from insufficient validation and missing safety mechanisms when handling symbolic links (symlinks). This can lead to infinite loops, uncontrolled recursion, and resource exhaustion when processing crafted or malformed filesystem structures. The root cause is the lack of cycle detection and depth limits during symlink resolution.
The patches address these issues by introducing several key changes:
Symlink Loop Detection: In helper/chroot/chroot.go, the resolveFollowedPath function was modified to detect and reject symlink loops. It now returns a syscall.ELOOP error if a symlink points to itself or creates a circular reference.
Maximum Symlink Follow Limit: The resolveFollowedPath function now includes a counter (followed) that limits the number of symlinks that can be followed during path resolution to a maximum of 8 (defined by maxFollowedSymlinks). This prevents excessive recursion and resource consumption.
Use of Lstat in removeAll: In util/util.go, the removeAll function was changed to use lstat instead of Stat. lstat does not follow symlinks, which prevents the function from entering an infinite loop when it encounters a symlink that creates a directory cycle.
By implementing these changes, the patched versions of go-billy are no longer vulnerable to denial-of-service attacks that exploit the mishandling of symlinks.
ChrootHelper.followedPathhelper/chroot/chroot.go
ChrootHelper.resolveFollowedPathhelper/chroot/chroot.go
ChrootHelper.resolveFollowedRoothelper/chroot/chroot.go
removeAllutil/util.go