Vulnerability-Lookup

RHSA-2026:94073

Vulnerability from csaf_redhat - Published: 2026-11-02 20:47 - Updated: 2026-11-08 10:56

Summary

Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.2 release.

Severity

Important

Notes

Topic: Red Hat Web Terminal Operator 1.17.2 has been released.

Details: The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-44740

A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64		—	Vendor Fix fix Workaround

Known not affected 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64	—	Workaround
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64	—	Workaround
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64	—	Workaround

Threats

Impact Important

CVE-2026-56852

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition

Affected products

Fixed 1 product

Product	Identifier	Version	Remediation
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64		—	Vendor Fix fix Workaround

Known not affected 3 products

Product	Version	Remediation
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64	—	Workaround
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64	—	Workaround
Unresolved product id: Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64	—	Workaround

Threats

Impact Important

CVE-2026-71556

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

CWE-59 - Improper Link Resolution Before File Access

Affected products

Fixed 1 product, the same list as for CVE-2026-44740

Known not affected 3 products, the same list as for CVE-2026-44740

Threats

Impact Important

References

32 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:94073	self
https://access.redhat.com/security/cve/CVE-2026-44740	external
https://access.redhat.com/security/cve/CVE-2026-56852	external
https://access.redhat.com/security/cve/CVE-2026-71556	external
https://access.redhat.com/security/updates/classi…	external
https://redhat.atlassian.net/browse/WTO-516	external
https://redhat.atlassian.net/browse/WTO-555	external
https://redhat.atlassian.net/browse/WTO-587	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-44740	self
https://bugzilla.redhat.com/show_bug.cgi?id=2483894	external
https://www.cve.org/CVERecord?id=CVE-2026-44740	external
https://nvd.nist.gov/vuln/detail/CVE-2026-44740	external
https://github.com/go-git/go-billy/releases/tag/v5.9.0	external
https://github.com/go-git/go-billy/releases/tag/v…	external
https://github.com/go-git/go-billy/security/advis…	external
https://access.redhat.com/security/cve/CVE-2026-56852	self
https://bugzilla.redhat.com/show_bug.cgi?id=2504233	external
https://www.cve.org/CVERecord?id=CVE-2026-56852	external
https://nvd.nist.gov/vuln/detail/CVE-2026-56852	external
https://go.dev/cl/794100	external
https://go.dev/issue/80142	external
https://pkg.go.dev/vuln/GO-2026-5970	external
https://access.redhat.com/security/cve/CVE-2026-71556	self
https://bugzilla.redhat.com/show_bug.cgi?id=2512562	external
https://www.cve.org/CVERecord?id=CVE-2026-71556	external
https://nvd.nist.gov/vuln/detail/CVE-2026-71556	external
https://github.com/go-git/go-git/commit/008a78f2d…	external
https://github.com/go-git/go-git/commit/661d1c7f1…	external
https://github.com/go-git/go-git/releases/tag/v5.19.2	external
https://github.com/go-git/go-git/releases/tag/v6.…	external
https://github.com/go-git/go-git/security/advisor…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Web Terminal Operator 1.17.2 has been released.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The Web Terminal provides a way to access a fully in-browser terminal emulator within the OpenShift Console. Command-line tools for interacting with the OpenShift cluster are pre-installed.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:94073",
        "url": "https://access.redhat.com/errata/RHSA-2026:94073"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-56852",
        "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-71556",
        "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-516",
        "url": "https://redhat.atlassian.net/browse/WTO-516"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-555",
        "url": "https://redhat.atlassian.net/browse/WTO-555"
      },
      {
        "category": "external",
        "summary": "https://redhat.atlassian.net/browse/WTO-587",
        "url": "https://redhat.atlassian.net/browse/WTO-587"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_94073.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Web Terminal Operator 1.17.2 release.",
    "tracking": {
      "current_release_date": "2026-11-08T10:56:47+00:00",
      "generator": {
        "date": "2026-11-08T10:56:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.5"
        }
      },
      "id": "RHSA-2026:94073",
      "initial_release_date": "2026-11-02T20:47:16+00:00",
      "revision_history": [
        {
          "date": "2026-11-02T20:47:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-11-02T20:47:25+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-11-08T10:56:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Web Terminal 1.17",
                "product": {
                  "name": "Red Hat Web Terminal 1.17",
                  "product_id": "Red Hat Web Terminal 1.17",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:webterminal:1.17::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Web Terminal"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-exec-rhel9@sha256%3Aad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-exec-rhel9\u0026tag=1793129583"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-rhel9-operator@sha256%3Ac2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-rhel9-operator\u0026tag=1793129593"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-operator-bundle@sha256%3Aba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-operator-bundle\u0026tag=1793204829"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64",
                "product": {
                  "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64",
                  "product_id": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/web-terminal-tooling-rhel9@sha256%3A0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3?arch=amd64\u0026repository_url=registry.redhat.io/web-terminal/web-terminal-tooling-rhel9\u0026tag=1793129608"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64 as a component of Red Hat Web Terminal 1.17",
          "product_id": "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64 as a component of Red Hat Web Terminal 1.17",
          "product_id": "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64 as a component of Red Hat Web Terminal 1.17",
          "product_id": "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64 as a component of Red Hat Web Terminal 1.17",
          "product_id": "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
        },
        "product_reference": "registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64",
        "relates_to_product_reference": "Red Hat Web Terminal 1.17"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-44740",
      "cwe": {
        "id": "CWE-606",
        "name": "Unchecked Input for Loop Condition"
      },
      "discovery_date": "2026-06-01T17:01:53.685793+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2483894"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Billy, an interface filesystem abstraction for Go. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing crafted or malformed input. The issue arises from insufficient validation and missing safety mechanisms when processing untrusted repository data and filesystem structures, leading to panics, infinite loops, uncontrolled recursion, or excessive resource consumption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is rated as an Important severity issue. The `go-billy` library, a Go filesystem abstraction, is vulnerable to a denial of service when processing crafted or malformed input, such as untrusted repository data or filesystem structures. Insufficient validation and missing safety mechanisms can lead to panics, infinite loops, or excessive resource consumption, potentially impacting the availability of applications that rely on this library.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2483894",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2483894"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44740"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
          "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
          "url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
          "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
        }
      ],
      "release_date": "2026-06-01T16:04:50.358000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:47:16+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94073"
        },
        {
          "category": "workaround",
          "details": "To mitigate the issue, we suggest upgrading to versions 5.9.0+ or 6.0.0-alpha.1+",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation"
    },
    {
      "cve": "CVE-2026-56852",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition"
      },
      "discovery_date": "2026-07-21T20:01:56.266823+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2504233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 (Unicode Transformation Format - 8-bit) bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of Service (DoS) condition where the affected application becomes unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Important: This flaw in the `golang.org/x/text` library can lead to a denial of service. An attacker could provide specially crafted invalid UTF-8 input to an application using the affected `norm.Iter` functionality, causing it to enter an infinite loop and become unresponsive.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "RHBZ#2504233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2504233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-56852",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56852"
        },
        {
          "category": "external",
          "summary": "https://go.dev/cl/794100",
          "url": "https://go.dev/cl/794100"
        },
        {
          "category": "external",
          "summary": "https://go.dev/issue/80142",
          "url": "https://go.dev/issue/80142"
        },
        {
          "category": "external",
          "summary": "https://pkg.go.dev/vuln/GO-2026-5970",
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "release_date": "2026-07-21T19:18:59.951000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:47:16+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94073"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input"
    },
    {
      "cve": "CVE-2026-71556",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access"
      },
      "discovery_date": "2026-08-07T16:51:14.251077+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2512562"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink, which, when cloned and its worktree operations are used, can lead to reading from or writing to arbitrary files outside the intended working directory. This could result in information disclosure or arbitrary file modification.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "go-git is a pure-Go implementation of Git. During worktree operations (checkout, status, add), go-git resolves symbolic links without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause a consuming application to read from or write to files outside the intended working directory when that repository is cloned and its worktree operations are used. Exploitation requires the application to clone an attacker-controlled repository and then perform worktree operations against it; applications that only process trusted repositories are not exposed. Red Hat rates the impact of this flaw as Important.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
        ],
        "known_not_affected": [
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
          "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "RHBZ#2512562",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2512562"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-71556",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
          "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
          "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
          "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
          "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
        }
      ],
      "release_date": "2026-08-07T16:37:40.058000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-11-02T20:47:16+00:00",
          "details": "To start using the Web Terminal Operator, install the Web Terminal Operator from OpenShift OperatorHub on OpenShift Container Platform 4.22 or higher.",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:94073"
        },
        {
          "category": "workaround",
          "details": "To reduce the risk of exploitation, do not clone or run worktree operations (checkout, status, add) on Git repositories originating from untrusted or attacker-controllable sources using an affected version of go-git. The issue is resolved by updating to go-git 5.19.2 or 6.0.0-alpha.5 (or later).",
          "product_ids": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-exec-rhel9@sha256:ad2e1604e05a84f0a301ea6a6554cb6ef847789bfe635520dbace820fde29f7a_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-operator-bundle@sha256:ba115046327065f2e34fc660e7f68f2418fecea4a07dd7e0c15ec995e4680664_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-rhel9-operator@sha256:c2ef5b7773324a0bc4fed27e3527c0f197148a787412d2a913e9757e95c2f55e_amd64",
            "Red Hat Web Terminal 1.17:registry.redhat.io/web-terminal/web-terminal-tooling-rhel9@sha256:0b7f24a14929daef656fbbdb70e55238924057a9cb52234a5fcca8a287e9d0e3_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "github.com/go-git/go-git/v5: go-git: Arbitrary file read/write via symbolic link resolution"
    }
  ]
}

CVE-2026-44740 (GCVE-0-2026-44740)

Vulnerability from cvelistv5 – Published: 2026-06-01 16:04 – Updated: 2026-06-01 18:14

Title

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Summary

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 18:13 UTC

CWE

CWE-674 - Uncontrolled Recursion
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/go-git/go-billy/security/advis…	x_refsource_CONFIRM
https://github.com/go-git/go-billy/releases/tag/v5.9.0	x_refsource_MISC
https://github.com/go-git/go-billy/releases/tag/v…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
go-git	go-billy	Affected: < 5.9.0 Affected: < 6.0.0-alpha.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-44740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T18:13:54.236447Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T18:14:04.315Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-billy",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.9.0"
            },
            {
              "status": "affected",
              "version": "\u003c 6.0.0-alpha.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-01T16:04:50.358Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"
        },
        {
          "name": "https://github.com/go-git/go-billy/releases/tag/v5.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-billy/releases/tag/v5.9.0"
        },
        {
          "name": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1"
        }
      ],
      "source": {
        "advisory": "GHSA-m3xc-h892-ggx6",
        "discovery": "UNKNOWN"
      },
      "title": "go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-44740",
    "datePublished": "2026-06-01T16:04:50.358Z",
    "dateReserved": "2026-05-07T18:04:17.310Z",
    "dateUpdated": "2026-06-01T18:14:04.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56852 (GCVE-0-2026-56852)

Vulnerability from cvelistv5 – Published: 2026-07-21 19:18 – Updated: 2026-08-10 22:57

Title

Infinite loop on invalid input in golang.org/x/text

Summary

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 13:26 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

Go CNA under the Google root

CNA scorecard E 42/100 over 64 records in the last 180 days details

References

3 references

URL	Tags
https://go.dev/issue/80142
https://go.dev/cl/794100
https://pkg.go.dev/vuln/GO-2026-5970

Impacted products

1 product

Vendor	Product	Version
golang.org/x/text	golang.org/x/text/unicode/norm	Affected: 0 , < 0.39.0 (semver)

Credits

Viky Choi ("vikychoi" on GitHub)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-56852",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T13:26:14.918983Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-835",
                "description": "CWE-835 Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T13:26:20.232Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "golang.org/x/text/unicode/norm",
          "product": "golang.org/x/text/unicode/norm",
          "programRoutines": [
            {
              "name": "nextComposed"
            },
            {
              "name": "Form.Append"
            },
            {
              "name": "Form.AppendString"
            },
            {
              "name": "Form.Bytes"
            },
            {
              "name": "Form.FirstBoundary"
            },
            {
              "name": "Form.FirstBoundaryInString"
            },
            {
              "name": "Form.IsNormal"
            },
            {
              "name": "Form.IsNormalString"
            },
            {
              "name": "Form.LastBoundary"
            },
            {
              "name": "Form.NextBoundary"
            },
            {
              "name": "Form.NextBoundaryInString"
            },
            {
              "name": "Form.Properties"
            },
            {
              "name": "Form.PropertiesString"
            },
            {
              "name": "Form.QuickSpan"
            },
            {
              "name": "Form.QuickSpanString"
            },
            {
              "name": "Form.Span"
            },
            {
              "name": "Form.SpanString"
            },
            {
              "name": "Form.String"
            },
            {
              "name": "Form.Transform"
            },
            {
              "name": "Iter.Init"
            },
            {
              "name": "Iter.InitString"
            },
            {
              "name": "Iter.Next"
            },
            {
              "name": "Iter.Seek"
            },
            {
              "name": "normReader.Read"
            },
            {
              "name": "normWriter.Write"
            }
          ],
          "vendor": "golang.org/x/text",
          "versions": [
            {
              "lessThan": "0.39.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Viky Choi (\"vikychoi\" on GitHub)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-10T22:57:54.703Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/80142"
        },
        {
          "url": "https://go.dev/cl/794100"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2026-5970"
        }
      ],
      "title": "Infinite loop on invalid input in golang.org/x/text"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2026-56852",
    "datePublished": "2026-07-21T19:18:59.951Z",
    "dateReserved": "2026-06-23T15:10:49.352Z",
    "dateUpdated": "2026-08-10T22:57:54.703Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-71556 (GCVE-0-2026-71556)

Vulnerability from cvelistv5 – Published: 2026-08-07 16:37 – Updated: 2026-08-07 16:58

Title

go-git: Worktree operations may follow symlinks

Summary

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 16:58 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7895 records in the last 180 days details

References

5 references

URL	Tags
https://github.com/go-git/go-git/security/advisor…	x_refsource_CONFIRM
https://github.com/go-git/go-git/commit/008a78f2d…	x_refsource_MISC
https://github.com/go-git/go-git/commit/661d1c7f1…	x_refsource_MISC
https://github.com/go-git/go-git/releases/tag/v5.19.2	x_refsource_MISC
https://github.com/go-git/go-git/releases/tag/v6.…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
go-git	go-git	Affected: < 5.19.2 Affected: >= 6.0.0-alpha.1, < 6.0.0-alpha.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-71556",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T16:58:08.599214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T16:58:19.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-git",
          "vendor": "go-git",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.19.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 6.0.0-alpha.1, \u003c 6.0.0-alpha.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T16:37:40.058Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-git/go-git/security/advisories/GHSA-hc8v-wwc9-vgxm"
        },
        {
          "name": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/commit/008a78f2dd86f52544ddff8b8e8ddeecdf3f7aab"
        },
        {
          "name": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/commit/661d1c7f101d34e002a3cfcf8dbea5b7421d07ac"
        },
        {
          "name": "https://github.com/go-git/go-git/releases/tag/v5.19.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/releases/tag/v5.19.2"
        },
        {
          "name": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-git/go-git/releases/tag/v6.0.0-alpha.5"
        }
      ],
      "source": {
        "advisory": "GHSA-hc8v-wwc9-vgxm",
        "discovery": "UNKNOWN"
      },
      "title": "go-git: Worktree operations may follow symlinks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-71556",
    "datePublished": "2026-08-07T16:37:40.058Z",
    "dateReserved": "2026-08-06T21:24:15.376Z",
    "dateUpdated": "2026-08-07T16:58:19.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:94073

CVE-2026-44740 (GCVE-0-2026-44740)

CVE-2026-56852 (GCVE-0-2026-56852)

CVE-2026-71556 (GCVE-0-2026-71556)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour