{"cve":"CVE-2026-44740","nvd":{"published":"2026-06-01T17:17:08.277","modified":"2026-07-22T07:10:00.107","status":"Deferred","description":"Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-674","CWE-835"],"references":["https://github.com/go-git/go-billy/releases/tag/v5.9.0","https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1","https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:37:48.043517290+00:00"},"epss":{"cve":"CVE-2026-44740","score":0.00389,"percentile":0.32993,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-m3xc-h892-ggx6","url":"https://osv.dev/vulnerability/GHSA-m3xc-h892-ggx6","summary":"go-billy: Lack of depth and cycle detection in symlink resolution may lead to infinite loops and resource exhaustion","modified":"2026-09-10T03:50:55.263613118Z","packages":[{"ecosystem":"Go","name":"github.com/go-git/go-billy/v5","purl":"pkg:golang/github.com/go-git/go-billy/v5","ranges":["<5.9.0"],"fixed":["5.9.0"]},{"ecosystem":"Go","name":"github.com/go-git/go-billy/v6","purl":"pkg:golang/github.com/go-git/go-billy/v6","ranges":["<6.0.0-alpha.1"],"fixed":["6.0.0-alpha.1"]}]},{"id":"GO-2026-5490","url":"https://osv.dev/vulnerability/GO-2026-5490","summary":"Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy","modified":"2026-08-08T21:41:53.435927217Z","packages":[{"ecosystem":"Go","name":"github.com/go-git/go-billy/v5","purl":"pkg:golang/github.com/go-git/go-billy/v5","ranges":["<5.9.0"],"fixed":["5.9.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}