Billy is an interface filesystem abstraction for Go. Prior to versions 5.9.0 and 6.0.0-alpha.1, multiple components may improperly handle crafted or malformed input, resulting in panics, infinite loops, uncontrolled recursion, or excessive resource consumption. These issues arise from insufficient validation and missing safety mechanisms such as cycle detection, recursion limits, or defensive handling of unexpected states when processing untrusted repository data and filesystem structures. This issue has been patched in versions 5.9.0 and 6.0.0-alpha.1.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade grafanaUpgrade grafana-selinux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | Upgrade grafana-debuginfoUpgrade grafana-selinuxUpgrade flightctl-observabilityUpgrade flightctl-agentUpgrade flightctl-selinuxUpgrade flightctl-servicesUpgrade grafana-debugsourceUpgrade flightctl-cliUpgrade grafana | Jul 17, 2026 | Jun 1, 2026 |
| Rocky_linux | — | Upgrade grafana-debugsourceUpgrade grafanaUpgrade grafana-selinuxUpgrade grafana-debuginfo | Jul 29, 2026 | Jul 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub