CVE-2026-44740 Details
Description
Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
A vulnerability exists in Go Billy, a filesystem abstraction library, in versions prior to 5.9.0 and 6.0.0-alpha.1. Multiple components may mishandle crafted or malformed input, causing panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These problems stem from inadequate validation and the absence of safety mechanisms like cycle detection, recursion limits, or defensive handling of unexpected states when dealing with untrusted repository data and filesystem structures.
Users should upgrade to Go Billy versions 5.9.0 or 6.0.0-alpha.1. Instructions for downloading these versions are available on the Go Billy GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-git/go-billy/releases/tag/v5.9.0 | [email protected] | Release NotesVendor |
| https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1 | [email protected] | Release NotesVendor |
| https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| go-git/go-billy | < 5.9.0 (semver) < 6.0.0-alpha.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |