Read the docs
TI-2026-32627 Aliases CVE-2026-44740GHSA-m3xc-h892-ggx6

go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion

Priority LOW 29CWE-674Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 37 fixed, 29 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-674.

Summary

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Partial go-billy (go-git): 5.9.0, 6.0.0-alpha.1github.com/go-git/go-billy/v5 (Go): 5.9.0+1 more productRed Hat: 43 advisoriesRed Hat: 37 fixed, 29 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
go-gitgo-billybefore 5.9.0; before 6.0.0-alpha.15.9.0, 6.0.0-alpha.1Patch availableCNA
—github.com/go-git/go-billy/v5 (Go)before 5.9.05.9.0Patch availableGHSA-m3xc-h892-ggx6
—github.com/go-git/go-billy/v6 (Go)before 6.0.0-alpha.16.0.0-alpha.1Patch availableGHSA-m3xc-h892-ggx6
  • go-billy Vendorgo-git Affected before 5.9.0; before 6.0.0-alpha.1 Fixed in 5.9.0, 6.0.0-alpha.1 Patch available CNA
  • github.com/go-git/go-billy/v5 (Go) Vendor— Affected before 5.9.0 Fixed in 5.9.0 Patch available GHSA-m3xc-h892-ggx6
  • github.com/go-git/go-billy/v6 (Go) Vendor— Affected before 6.0.0-alpha.1 Fixed in 6.0.0-alpha.1 Patch available GHSA-m3xc-h892-ggx6

Remediation

  • Fix · CNA go-billy (go-git) Fixed in 5.9.0, 6.0.0-alpha.1
  • Fix · GHSA-m3xc-h892-ggx6 github.com/go-git/go-billy/v5 (Go) Fixed in 5.9.0 Advisory →
  • Fix · GHSA-m3xc-h892-ggx6 github.com/go-git/go-billy/v6 (Go) Fixed in 6.0.0-alpha.1 Advisory →

Red Hat 43 advisories

  • RHSA-2026:94094 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.15.3 release.
    • Red Hat Web Terminal 1.15 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94074 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.14.2 release.
    • Red Hat Web Terminal 1.14 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94073 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.17.2 release.
    • Red Hat Web Terminal 1.17 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
Show 40 more Red Hat advisories
  • RHSA-2026:94072 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.11.3 release.
    • Red Hat Web Terminal 1.11 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94071 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.16.3 release.
    • Red Hat Web Terminal 1.16 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:94070 Released 2026-11-02 · Red Hat rating Important
    Red Hat Web Terminal Operator 1.13.2 release.
    • Red Hat Web Terminal 1.13 registry.redhat.io/web-terminal/web-terminal-exec-rhel9, registry.redhat.io/web-terminal/web-terminal-rhel9-operator, registry.redhat.io/web-terminal/web-terminal-tooling-rhel9
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:68334 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • RHEM 1.1 for RHEL 10 flightctl-1.1.4-1.el10em, flightctl-agent-1.1.4-1.el10em, flightctl-cli-1.1.4-1.el10em
    • RHEM 1.1 for RHEL 9 flightctl-1.1.4-1.el9em, flightctl-agent-1.1.4-1.el9em, flightctl-cli-1.1.4-1.el9em
  • RHSA-2026:68335 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • RHEM 1.2 for RHEL 10 flightctl-1.2.1-1.el10, flightctl-agent-1.2.1-1.el10, flightctl-cli-1.2.1-1.el10
    • RHEM 1.2 for RHEL 9 flightctl-1.2.1-1.el9, flightctl-agent-1.2.1-1.el9, flightctl-cli-1.2.1-1.el9
  • RHSA-2026:68254 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +11
  • RHSA-2026:68253 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel9, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel9, registry.redhat.io/rhem/flightctl-api-rhel9 +10
  • RHSA-2026:68044 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.1.4 Security Update
    • Red Hat Edge Manager 1.1 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:68006 Released 2026-09-16 · Red Hat rating Important
    Red Hat Edge Manager Version 1.2.1 Security Update
    • Red Hat Edge Manager 1.2 registry.redhat.io/rhem/flightctl-alert-exporter-rhel10, registry.redhat.io/rhem/flightctl-alertmanager-proxy-rhel10, registry.redhat.io/rhem/flightctl-api-rhel10 +11
  • RHSA-2026:66022 Released 2026-09-09 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.5 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +4
  • RHSA-2026:63142 Released 2026-09-03 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.21.4 security update
    • Red Hat OpenShift GitOps 1.21 registry.redhat.io/openshift-gitops-1/argocd-rhel9, registry.redhat.io/openshift-gitops-1/gitops-rhel9-operator
  • RHSA-2026:61314 Released 2026-08-31 · Red Hat rating Important
    Cluster Observability Operator 1.5.2
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-health-analyzer-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator +10
  • RHSA-2026:60388 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.14.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.14 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +26
  • RHSA-2026:60387 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.11.11 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.11 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-must-gather-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +24
  • RHSA-2026:60386 Released 2026-08-26 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.17.1 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.17 registry.redhat.io/rhacm2/acm-governance-policy-addon-controller-rhel9, registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9 +31
  • RHSA-2026:59593 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.17.2 security update
    • multicluster engine for Kubernetes 2.17 registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +6
  • RHSA-2026:59559 Released 2026-08-25 · Red Hat rating Important
    multicluster engine for Kubernetes v2.9.7 security update
    • multicluster engine for Kubernetes 2.9 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9 +15
  • RHSA-2026:59467 Released 2026-08-25 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.4 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +3
  • RHSA-2026:57194 Released 2026-08-19 · Red Hat rating Important
    multicluster engine for Kubernetes v2.11.5 security update
    • multicluster engine for Kubernetes 2.11 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-api-provider-kubevirt-rhel9 +11
  • RHSA-2026:57191 Released 2026-08-19 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.16.3 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.16 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9 +15
  • RHSA-2026:57013 Released 2026-08-19 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.20.17 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.20 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +19
  • RHSA-2026:56366 Released 2026-08-18 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.22 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:54525 Released 2026-08-13 · Red Hat rating Important
    external secrets operator for Red Hat OpenShift 1.1.1
    • external secrets operator for Red Hat OpenShift 1.1 registry.redhat.io/external-secrets-operator/external-secrets-rhel9
  • RHSA-2026:54427 Released 2026-08-12 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.5 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:51033 Released 2026-08-06 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:50869 Released 2026-08-05 · Red Hat rating Important
    RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9, registry.redhat.io/rhtas/rekor-cli-rhel9
  • RHSA-2026:47737 Released 2026-07-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.10 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +6
  • RHSA-2026:47735 Released 2026-07-29 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.8.9 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9 +5
  • RHSA-2026:47451 Released 2026-07-28 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:47388 Released 2026-07-28 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46903 Released 2026-07-27 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.15.4 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.15 registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9, registry.redhat.io/rhacm2/acm-prometheus-rhel9, registry.redhat.io/rhacm2/console-rhel9 +9
  • RHSA-2026:46885 Released 2026-07-27 · Red Hat rating Critical
    multicluster engine for Kubernetes v2.10.4 security update
    • multicluster engine for Kubernetes 2.10 registry.redhat.io/multicluster-engine/cluster-image-set-controller-rhel9, registry.redhat.io/multicluster-engine/cluster-proxy-rhel9, registry.redhat.io/multicluster-engine/console-mce-rhel9 +4
  • RHSA-2026:46391 Released 2026-07-27 · Red Hat rating Important
    grafana security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) grafana-9.2.10-32.el8_10, grafana-selinux-9.2.10-32.el8_10
  • RHSA-2026:40972 Released 2026-07-16 · Red Hat rating Important
    RHTAS 1.3.6 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/cosign-rhel9, registry.redhat.io/rhtas/fetch-tsa-certs-rhel9, registry.redhat.io/rhtas/gitsign-rhel9 +2
  • RHSA-2026:37387 Released 2026-07-09 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.22 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/devicefinder-rhel9 +24
  • RHSA-2026:36873 Released 2026-07-08 · Red Hat rating Important
    Submariner v0.20 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/lighthouse-agent-rhel9, registry.redhat.io/rhacm2/lighthouse-coredns-rhel9, registry.redhat.io/rhacm2/nettest-rhel9 +5
  • RHSA-2026:35111 Released 2026-07-02 · Red Hat rating Important
    Red Hat Hardened Images RPMs Security Update
    • Red Hat Hardened Images trivy-0.72.0-0.1.hum1@aarch64, trivy-0.72.0-0.1.hum1@src, trivy-0.72.0-0.1.hum1@x86_64
  • RHSA-2026:32974 Released 2026-06-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images syft-1.46.0-0.1.hum1@aarch64, syft-1.46.0-0.1.hum1@src, syft-1.46.0-0.1.hum1@x86_64
  • RHSA-2026:32963 Released 2026-06-29 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images grype-0.115.0-0.1.hum1@aarch64, grype-0.115.0-0.1.hum1@src, grype-0.115.0-0.1.hum1@x86_64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix yet
Builds for Red Hat OpenShiftAffectedNo fix yet
Confidential Compute AttestationAffectedNo fix planned: Will not fix
Exploit IntelligenceAffectedNo fix yet
External Secrets Operator for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Kernel Module Management Operator for Red Hat OpenshiftAffectedNo fix yet
Machine Deletion Remediation OperatorAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Multicluster Engine for KubernetesAffectedNo fix yet
Node HealthCheck OperatorAffectedNo fix yet
OpenShift Developer Tools and ServicesAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
OpenShift Service Mesh 2AffectedNo fix planned: Will not fix
Power monitoring for Red Hat OpenShiftAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Security 4AffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 9AffectedNo fix yet: Fix deferred
Red Hat Developer Hub 1AffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift Dev Workspaces OperatorAffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 17.1AffectedNo fix yet
Red Hat Trusted Artifact SignerAffectedNo fix yet
Cluster Observability Operator 1.5Fixed RHSA-2026:61314
OpenShift API for Data Protection 1.3Fixed RHSA-2026:51033
OpenShift API for Data Protection 1.4Fixed RHSA-2026:59467
OpenShift API for Data Protection 1.5Fixed RHSA-2026:66022
RHEM 1.1 for RHEL 10Fixed RHSA-2026:68334
RHEM 1.1 for RHEL 9Fixed RHSA-2026:68334
RHEM 1.2 for RHEL 10Fixed RHSA-2026:68335
RHEM 1.2 for RHEL 9Fixed RHSA-2026:68335
Red Hat Advanced Cluster Management for Kubernetes 2.11Fixed RHSA-2026:60387
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:36873, RHSA-2026:47737
Red Hat Advanced Cluster Management for Kubernetes 2.14Fixed RHSA-2026:60388
Red Hat Advanced Cluster Management for Kubernetes 2.15Fixed RHSA-2026:46903, RHSA-2026:54427
Red Hat Advanced Cluster Management for Kubernetes 2.16Fixed RHSA-2026:57191
Red Hat Advanced Cluster Management for Kubernetes 2.17Fixed RHSA-2026:60386
Red Hat Edge Manager 1.1Fixed RHSA-2026:68044, RHSA-2026:68253
Red Hat Edge Manager 1.2Fixed RHSA-2026:68006, RHSA-2026:68254
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:46391
Red Hat Hardened ImagesFixed RHSA-2026:32963, RHSA-2026:32974, RHSA-2026:35111
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Red Hat OpenShift GitOps 1.21Fixed RHSA-2026:63142
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:56366
Red Hat Openshift Data Foundation 4.20Fixed RHSA-2026:57013
Red Hat Openshift Data Foundation 4.22Fixed RHSA-2026:37387
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:40972
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:50869
Red Hat Web Terminal 1.11Fixed RHSA-2026:94072
Red Hat Web Terminal 1.13Fixed RHSA-2026:94070
Red Hat Web Terminal 1.14Fixed RHSA-2026:94074
Red Hat Web Terminal 1.15Fixed RHSA-2026:94094
Red Hat Web Terminal 1.16Fixed RHSA-2026:94071
Red Hat Web Terminal 1.17Fixed RHSA-2026:94073
external secrets operator for Red Hat OpenShift 1.1Fixed RHSA-2026:54525
multicluster engine for Kubernetes 2.10Fixed RHSA-2026:46885
multicluster engine for Kubernetes 2.11Fixed RHSA-2026:57194
multicluster engine for Kubernetes 2.17Fixed RHSA-2026:59593
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:47735
multicluster engine for Kubernetes 2.9Fixed RHSA-2026:59559
Not affected: 55 products
  • Cluster Observability Operator 1.5
  • Logging Subsystem for Red Hat OpenShift
  • Logical Volume Manager Storage
  • Migration Toolkit for Containers
  • Migration Toolkit for Virtualization
  • OpenShift API for Data Protection 1.3
  • OpenShift API for Data Protection 1.4
  • OpenShift API for Data Protection 1.5
  • OpenShift Developer Tools and Services
  • OpenShift Service Mesh 3
  • Pen Drive Powered by Red Hat Lightspeed
  • RHEM 1.1 for RHEL 10
  • RHEM 1.1 for RHEL 9
  • RHEM 1.2 for RHEL 10
  • RHEM 1.2 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.11
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Advanced Cluster Management for Kubernetes 2.15
  • Red Hat Advanced Cluster Management for Kubernetes 2.16
  • Red Hat Advanced Cluster Management for Kubernetes 2.17
  • Red Hat Advanced Cluster Security 4
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Kueue
  • Red Hat Edge Manager 1.1
  • Red Hat Edge Manager 1.2
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.21
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Openshift Data Foundation 4.20
  • Red Hat Openshift Data Foundation 4.22
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat Trusted Artifact Signer 1.4
  • Red Hat Web Terminal 1.11
  • Red Hat Web Terminal 1.13
  • Red Hat Web Terminal 1.14
  • Red Hat Web Terminal 1.15
  • Red Hat Web Terminal 1.16
  • Red Hat Web Terminal 1.17
  • multicluster engine for Kubernetes 2.10
  • multicluster engine for Kubernetes 2.11
  • multicluster engine for Kubernetes 2.17
  • multicluster engine for Kubernetes 2.8
  • multicluster engine for Kubernetes 2.9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44740
  2. 2026-10-03 Alias added: GHSA-m3xc-h892-ggx6
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-23 Affected versions changed · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-10-30 Affected versions changed · Red Hat
  8. 2026-11-03 Fix available: RHSA-2026:94094 · Red Hat
  9. 2026-11-03 Fix available: RHSA-2026:94074 · Red Hat
  10. 2026-11-03 Fix available: RHSA-2026:94072 · Red Hat
  11. 2026-11-03 Fix available: RHSA-2026:94071 · Red Hat
  12. 2026-11-03 Fix available: RHSA-2026:94070 · Red Hat
  13. 2026-11-03 Fix available: RHSA-2026:94073 · Red Hat
  14. 2026-11-03 Fix available: Red Hat Web Terminal 1.11, Red Hat Web Terminal 1.13, Red Hat Web Terminal 1.14 +3 · Red Hat
  15. 2026-11-05 Fix available: Cluster Observability Operator 1.5 · Red Hat

References

Advisory 1

Other 4

  • TI-2023-27070 Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients CVSS 3.1CRITICAL 9.8
  • TI-2025-15573 go-git has an Argument Injection via the URL field CVSS 4.0CRITICAL 9.2
  • TI-2025-15574 go-git clients vulnerable to DoS via maliciously crafted Git server replies CVSS 3.1HIGH 7.5
  • TI-2026-32835 Billy: Path traversal vulnerabilities CVSS 3.1HIGH 8.1
  • TI-2023-27069 Maliciously crafted Git server replies can cause DoS on go-git clients CVSS 3.1HIGH 7.5
  • TI-2026-30091 go-git Credential leak via cross-host redirect in smart HTTP transport CVSS 3.1HIGH 7.4
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences