PT-2026-40715 · Go-Billy · Go-Billy

Faran66 · Published 2026-05-13 · Updated 2026-06-11 · CVE-2026-44740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions go-billy versions prior to v5

Description Multiple components improperly handle crafted or malformed input, which can lead to panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues result from insufficient validation and a lack of safety mechanisms, such as cycle detection, recursion limits, or defensive handling of unexpected states, when processing untrusted repository data and filesystem structures.

Recommendations Upgrade to a supported go-billy version v5 or later.

Fix

Uncontrolled Recursion

Infinite Loop

Weakness Enumeration

CWE-674

CWE-835

Related Identifiers

CLEANSTART-2026-AQ65185

CLEANSTART-2026-BG69533

CLEANSTART-2026-DM19620

CLEANSTART-2026-QP84300

CLEANSTART-2026-UY49411

CVE-2026-44740

GHSA-M3XC-H892-GGX6

OPENSUSE-SU-2026:10856-1

OPENSUSE-SU-2026:10941-1

OPENSUSE-SU-2026:10943-1

OPENSUSE-SU-2026:10967-1

OPENSUSE-SU-2026:10996-1

OPENSUSE-SU-2026:20956-1

Affected Products

Go-Billy

References · 166

• https://osv.dev/vulnerability/openSUSE-SU-2026:20956-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47913 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://osv.dev/vulnerability/CLEANSTART-2026-DM19620 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33810 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-44740 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10996-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39817 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33813 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32289 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42501 · Security Note
• https://osv.dev/vulnerability/GHSA-m3xc-h892-ggx6 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10943-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58181 · Security Note