CVE-2026-44740
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Jun 1, 2026
CISA due date
—
The record
Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | amazon-ssm-agent | 0 | 3.3.4624.0-160000.1.1 |
| openSUSE:Leap 16.0 | trivy | 0 | 0.71.0-160000.1.1 |
| openSUSE:Leap 16.0 | trivy | 0 | 0.71.2-160000.1.1 |
| openSUSE:Tumbleweed | alloy | 0 | 1.17.0-1.1 |
| openSUSE:Tumbleweed | amazon-ssm-agent | 0 | 3.3.4624.0-1.1 |
| openSUSE:Tumbleweed | cheat | 0 | 5.1.0-2.1 |
| openSUSE:Tumbleweed | git-bug | 0 | 0.10.1-6.1 |
| openSUSE:Tumbleweed | rclone | 0 | 1.74.2-1.1 |
| openSUSE:Tumbleweed | trivy | 0 | 0.71.0-1.1 |
Related vulnerabilities
- CVE-2026-39821 The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that… Also affects amazon-ssm-agent
- CVE-2026-46597 An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM… Also affects amazon-ssm-agent
- CVE-2026-46598 For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire… Also affects amazon-ssm-agent
- CVE-2026-42508 Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for… Also affects amazon-ssm-agent
- CVE-2026-46595 Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server… Also affects amazon-ssm-agent
- CVE-2026-39835 SSH servers which use CertChecker as a public key callback without setting… Also affects amazon-ssm-agent
- CVE-2026-39834 When writing data larger than 4GB in a single Write call on an SSH channel, an integer… Also affects amazon-ssm-agent
- CVE-2026-39829 The RSA and DSA public key parsers did not enforce size limits on key parameters. Also affects amazon-ssm-agent