Medium severity4.3NVD Advisory· Published Mar 6, 2026· Updated Jul 7, 2026
CVE-2026-29049
CVE-2026-29049
Description
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
chainguard.dev/melangeGo | < 0.43.4 | 0.43.4 |
Affected products
12- osv-coords10 versionspkg:apk/chainguard/apply-cve-bumppkg:golang/chainguard.dev/melangepkg:apk/chainguard/melangepkg:apk/chainguard/wolfictlpkg:apk/wolfi/melangepkg:apk/wolfi/wolfictlpkg:apk/chainguard/cgpkg:apk/chainguard/dlpkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 0.2.300-r0+ 9 more
- (no CPE)range: < 0.2.300-r0
- (no CPE)range: <= 0.40.5
- (no CPE)range: < 0
- (no CPE)range: < 0.39.20-r1
- (no CPE)range: < 0
- (no CPE)range: < 0.39.20-r1
- (no CPE)range: < 0.2.300-r0
- (no CPE)range: < 0.0.20260623145845-r0
- (no CPE)range: < 0.0.20260723T184607-160000.1.1
- (no CPE)range: < 0.0.20260317T205859-150000.1.152.1
<= 0.40.5+ 1 more
- (no CPE)range: <= 0.40.5
- cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*range: <=0.40.5
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-7rp8-r62p-q6wcghsaADVISORY
- github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wcnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2026-29049ghsaADVISORY
- github.com/chainguard-dev/melange/commit/652ca5af08588f78e2d405e64b058fac8398d23fnvdWEB
- github.com/chainguard-dev/melange/pull/2379nvdWEB
- github.com/chainguard-dev/melange/releases/tag/v0.43.4nvdWEB
News mentions
0No linked articles in our index yet.