CVE-2026-29049

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-29049
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/chainguard-dev/melange/commit/652ca5af08588f78e2d405e64b058fac8398d23f
https://github.com/chainguard-dev/melange/pull/2379
https://github.com/chainguard-dev/melange/releases/tag/v0.43.4
https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*
History

07 Jul 2026, 14:16

Type Values Removed Values Added
References
  • () https://github.com/chainguard-dev/melange/commit/652ca5af08588f78e2d405e64b058fac8398d23f -
  • () https://github.com/chainguard-dev/melange/pull/2379 -
  • () https://github.com/chainguard-dev/melange/releases/tag/v0.43.4 -
Summary (en) melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available. (en) melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.

10 Mar 2026, 19:28

Type Values Removed Values Added
References () https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc - () https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc - Vendor Advisory
Summary
  • (es) melange permite a los usuarios construir paquetes apk utilizando pipelines declarativos. En la versión 0.40.5 y anteriores, melange update-cache descarga URIs de configuraciones de compilación a través de io.Copy sin ningún límite de tamaño o tiempo de espera del cliente HTTP (pkg/renovate/cache/cache.go). Una URI controlada por un atacante en una configuración de melange puede causar escrituras de disco ilimitadas, agotando el disco en el ejecutor de compilación. No hay ningún parche conocido disponible públicamente.
CPE cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*
First Time Chainguard
Chainguard melange

06 Mar 2026, 07:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-06 07:16

Updated : 2026-07-07 14:16

NVD link : CVE-2026-29049

Mitre link : CVE-2026-29049

CVE.ORG link : CVE-2026-29049

JSON object : View

Products Affected

chainguard

  • melange
CWE
CWE-400

Uncontrolled Resource Consumption

CWE-918

Server-Side Request Forgery (SSRF)