CVE-2026-44740

Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.

• CWE-674
• CWE-835

• https://github.com/go-git/go-billy/releases/tag/v5.9.0
• https://github.com/go-git/go-billy/releases/tag/v6.0.0-alpha.1
• https://github.com/go-git/go-billy/security/advisories/GHSA-m3xc-h892-ggx6

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44735OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44736OpenProject is open-source, web-based project management sof…6.5
• CVE-2026-44737grav-plugin-admin is the admin plugin for Grav is an HTML us…6.2
• CVE-2026-44738Grav is a file-based Web platform. Prior to 2.0.0-rc.2, the …7.7
• CVE-2026-44739Pimcore is an Open Source Data & Experience Management Platf…8.7
• CVE-2026-4474A flaw has been found in itsourcecode University Management …6.1
• CVE-2026-44742Postorius through 1.3.13 does not escape HTML in the message…6.1
• CVE-2026-44743Under certain conditions, when an unauthorized attacker acce…3.7
• CVE-2026-44744SAP S/4HANA(On-Premise) contains SQL injection vulnerability…6.5
• CVE-2026-44745SAP Approuter does not properly validate incoming request he…8.1
• CVE-2026-44746Due to a reflected cross-site scripting (XSS) vulnerability …6.1
• CVE-2026-44747SAP NetWeaver Application Server ABAP allows an authenticate…9.9