CVE-2026-44740

Name of the Vulnerable Software and Affected Versions go-billy versions prior to v5

Description Multiple components improperly handle crafted or malformed input, which can lead to panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues result from insufficient validation and a lack of safety mechanisms, such as cycle detection, recursion limits, or defensive handling of unexpected states, when processing untrusted repository data and filesystem structures.

Recommendations Upgrade to a supported go-billy version v5 or later.