CVE-2026-29049

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*

History

No history.

Information

Published : 2026-03-06 07:16

Updated : 2026-03-10 19:28

NVD link : CVE-2026-29049

Mitre link : CVE-2026-29049

CVE.ORG link : CVE-2026-29049

JSON object : View

Products Affected

chainguard

melange

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-29049", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2026-03-06T07:16:02.093", "references": [{"url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available."}, {"lang": "es", "value": "melange permite a los usuarios construir paquetes apk utilizando pipelines declarativos. En la versi\u00f3n 0.40.5 y anteriores, melange update-cache descarga URIs de configuraciones de compilaci\u00f3n a trav\u00e9s de io.Copy sin ning\u00fan l\u00edmite de tama\u00f1o o tiempo de espera del cliente HTTP (pkg/renovate/cache/cache.go). Una URI controlada por un atacante en una configuraci\u00f3n de melange puede causar escrituras de disco ilimitadas, agotando el disco en el ejecutor de compilaci\u00f3n. No hay ning\u00fan parche conocido disponible p\u00fablicamente."}], "lastModified": "2026-03-10T19:28:57.330", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "03E019F3-C40D-4A30-9A0C-8B4CC7D2FF8A", "versionEndIncluding": "0.40.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}