Interface Filesystem Abstraction Vulnerability in Billy by Go

CVE-2026-44740

What is CVE-2026-44740?

Billy, an interface filesystem abstraction for Go, exhibited multiple vulnerability flaws prior to versions 5.9.0 and 6.0.0-alpha.1. These flaws can lead to panics, infinite loops, and excessive resource consumption due to improper handling of crafted or malformed input. The absence of crucial safety mechanisms, like cycle detection and recursion limits, along with insufficient validation, allows these issues to arise when processing untrusted data and filesystem structures. Users are advised to upgrade to patched versions to mitigate potential risks.

References