The flaw in go-billy stems from a lack of depth and cycle detection when resolving symbolic links. The library may follow symlinks without checking for loops or exceeding a recursion limit, leading to infinite recursion, panics, or uncontrolled consumption of system resources. This can be leveraged by supplying crafted repository data, causing denial of service through excessive CPU or memory usage. The vulnerability is aligned with CWE-674 and CWE-835.

The issue affects the go-billy component of the go-git project. Versions prior to 5.9.0 and the 6.0.0-alpha.1 pre‑release are impacted. Any Go application that imports or depends on go-billy for filesystem abstraction is potentially vulnerable.

The CVSS score of 6.5 indicates a moderate severity. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it may not yet have widespread exploitation. The attack vector is inferred to be remote or local, depending on whether the Go application processes input from untrusted sources such as external git repositories. A malicious actor could target the application by supplying a repository containing a symlink loop, triggering the runaway recursion and exhausting resources.