UnratedFix available

DEBIAN-CVE-2026-44740

Type: advisorySource: OSV1 source record

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

Announced 1 Jun 2026Source revision 1

Original source ↗

DEBIAN-CVE-2026-44740

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-44740

golang-github-go-git-go-billy

Source reference: /affected/0/package/name

Affected versions: 5.3.1-3
Source reference: /affected/0/versions
5.5.0-1
Source reference: /affected/0/versions
5.5.0-2
Source reference: /affected/0/versions
5.8.0-1
Source reference: /affected/0/versions
5.9.0-1
Source reference: /affected/0/versions
5.9.1-1
Source reference: /affected/0/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

golang-github-go-git-go-billy

Source reference: /affected/1/package/name

Affected versions: 5.5.0-1
Source reference: /affected/1/versions
5.5.0-2
Source reference: /affected/1/versions
5.8.0-1
Source reference: /affected/1/versions
5.9.0-1
Source reference: /affected/1/versions
5.9.1-1
Source reference: /affected/1/versions
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

golang-github-go-git-go-billy

Source reference: /affected/2/package/name

Affected versions: 5.5.0-1
Source reference: /affected/2/versions
5.5.0-2
Source reference: /affected/2/versions
5.8.0-1
Source reference: /affected/2/versions
Fixed versions: 5.9.0-1
Source reference: /affected/2/ranges
Prerequisites: Not stated in this record

golang-github-go-git-go-billy-v6

Source reference: /affected/3/package/name

Affected versions: 6~git20260226.45bd095-1
Source reference: /affected/3/versions
6~git20260226.45bd095-2
Source reference: /affected/3/versions
Fixed versions: 6.0.0~alpha.1-1
Source reference: /affected/3/ranges
Prerequisites: Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-github-go-git-go-billy",
      "purl": "pkg:deb/debian/golang-github-go-git-go-billy?arch=source&distro=bookworm",
      "ecosystem": "Debian:12"
    },
    "versions": [
      "5.3.1-3",
      "5.5.0-1",
      "5.5.0-2",
      "5.8.0-1",
      "5.9.0-1",
      "5.9.1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44740.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-github-go-git-go-billy",
      "purl": "pkg:deb/debian/golang-github-go-git-go-billy?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "5.5.0-1",
      "5.5.0-2",
      "5.8.0-1",
      "5.9.0-1",
      "5.9.1-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44740.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "5.9.0-1"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-github-go-git-go-billy",
      "purl": "pkg:deb/debian/golang-github-go-git-go-billy?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "5.5.0-1",
      "5.5.0-2",
      "5.8.0-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44740.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "6.0.0~alpha.1-1"
          }
        ]
      }
    ],
    "package": {
      "name": "golang-github-go-git-go-billy-v6",
      "purl": "pkg:deb/debian/golang-github-go-git-go-billy-v6?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "6~git20260226.45bd095-1",
      "6~git20260226.45bd095-2"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-44740.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event: #57134 · Revision 1
Added to Heist Feed: Sun, 25 Oct 2026 17:01:54 GMT
Publisher date: Mon, 01 Jun 2026 17:17:08 GMT

Read the original announcement