CVE-2026-44740

Aliases:GHSA-m3xc-h892-ggx6
Advisory lineage Upstream: 0 Downstream: 21
Deferred
Published: 01 Jun 2026, 16:04
Last modified:01 Jun 2026, 18:14

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.29% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

01 Jun 2026, 16:04
Published
Vulnerability first disclosed
01 Jun 2026, 18:14
Last Modified
Vulnerability information updated

Description

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.29%• Percentile: 21%

Techniques & Countermeasures

  • CWE-674•Uncontrolled Recursion

    The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Systems

  • go-git•go-billy

    < 5.9.0 | < 6.0.0-alpha.1

  • github.com/go-git/go-billy•v5

    < 5.9.0

  • github.com/go-git/go-billy•v6

    < 6.0.0-alpha.1

References (5)