CVE-2026-44740

6.5 Moyenne

Publiée le 01/06/2026 à 19:17 · Modifiée le 22/07/2026 à 09:10 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Traduire en français

Produits concernés

go-git go-billy

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-674
CWE-835

Références

https://github.com/go-git/go-billy/releases/tag/v5.9.0
https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories