CVE-2026-44740: Billy Go Library Denial-of-Service via Input Validation Flaws

Technical summary

Billy fails to properly validate and sanitize crafted or malformed input across multiple components, resulting in uncontrolled recursion, infinite loops, and resource exhaustion. The root causes stem from insufficient input validation, absent cycle detection mechanisms, missing recursion depth limits, and inadequate handling of unexpected filesystem or repository states. The vulnerability is reachable by authenticated network users (PR:L per CVSS vector) who supply malicious data to Billy's interface abstraction layer. The library does not gracefully degrade when encountering cyclic or deeply nested structures.

Business impact

Applications using Billy are exposed to availability risks. An authenticated attacker can craft inputs that crash services or consume CPU and memory, disrupting operations. The impact is limited to availability—no data confidentiality or integrity loss occurs—but repeated attacks could enable a targeted denial-of-service campaign against systems relying on Billy for filesystem abstraction.

Affected systems

Go applications and services that depend on Billy versions prior to 5.9.0 and 6.0.0-alpha.1 are affected. The vulnerability requires authenticated network access, so it is most relevant to systems where untrusted users can send requests that Billy processes, such as microservices, build pipelines, or storage systems that parse external repository metadata or filesystem structures.

Exploitability

Exploitation requires authentication and network access, placing this at CVSS Low Complexity with a CVSS score of 6.5 (MEDIUM). An attacker must already have valid credentials or access privileges. However, once authenticated, triggering the vulnerability is trivial—sending a specially crafted input is sufficient to cause a panic or resource exhaustion. The barrier to exploitation is authentication, not technical sophistication. Billy is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of this publication.

Remediation

Update Billy to version 5.9.0 or 6.0.0-alpha.1 (or later stable releases) immediately. The patched versions introduce input validation, cycle detection, recursion limits, and defensive state handling. Review your dependency tree to identify all affected services, prioritize those accepting untrusted input, and apply patches in a controlled deployment cycle.

Patch guidance

Verify the version of Billy in your Go modules (check go.mod and go.sum). For production systems, upgrade to version 5.9.0 if you are on the stable v5 line, or plan migration to v6 if adopting pre-release versions. Test patched builds in a staging environment to confirm compatibility with your application logic. For long-term users on v5, monitor Billy's release schedule for stable v6 availability.

Detection guidance

Monitor application logs for panic messages or crashes originating from Billy components, particularly when processing filesystem or repository data. Watch for sustained CPU or memory spikes during normal operations. Implement network-based detection for authentication failures followed by requests containing unusual patterns (deeply nested structures, circular references, or repeated path traversals). Consider deploying resource limits (CPU timeouts, memory quotas) on services using Billy to limit blast radius.

Why prioritize this

While CVSS 6.5 is medium severity, prioritize this based on your architecture. If Billy processes untrusted input from external sources or multi-tenant environments, upgrade immediately. If Billy is used only internally with trusted data sources, deferral to a standard patch cycle is acceptable. The lack of KEV status and exploitation details in the wild suggests low active exploitation risk, but the ease of triggering denial-of-service after authentication makes this a useful hardening target.

Risk score, explained

The CVSS 6.5 (MEDIUM) score reflects high availability impact (AV:N/AC:L/A:H) tempered by the requirement for authenticated access (PR:L). There is no confidentiality or integrity loss. The score appropriately captures a real but bounded threat—an attacker with credentials can disrupt service, but cannot breach data or escalate privileges. In zero-trust or high-multitenancy environments, treat this as higher priority.

Frequently asked questions