melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI
Priority LOW 20CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00263 18th percentileScored 2026-11-07
Fix Fixed melange (chainguard-dev): 0.43.4chainguard.dev/melange (Go): 0.43.4
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chainguard-dev | melange | before 0.43.4 | 0.43.4 | Patch available | CNA |
| — | chainguard.dev/melange (Go) | before 0.43.4 | 0.43.4 | Patch available | GHSA-7rp8-r62p-q6wc |
- melange Vendorchainguard-dev Affected before 0.43.4 Fixed in 0.43.4 Patch available CNA
- chainguard.dev/melange (Go) Vendor— Affected before 0.43.4 Fixed in 0.43.4 Patch available GHSA-7rp8-r62p-q6wc
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:* | up to 0.40.5 | Vulnerable | chainguard-dev |
- cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:* Versions up to 0.40.5 Vulnerable ·chainguard-dev
Remediation
- Fix · CNA melange (chainguard-dev) Fixed in 0.43.4
- Fix · GHSA-7rp8-r62p-q6wc chainguard.dev/melange (Go) Fixed in 0.43.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-29049
- 2026-10-03 Alias added: GHSA-7rp8-r62p-q6wc
References
Advisory 2
More chainguard-dev Melange vulnerabilities
- TI-2026-20043 melange pipeline working-directory could allow command injection CVSS 3.1HIGH 8.8
- TI-2026-20042 melange QEMU runner could write files outside workspace directory CVSS 3.1HIGH 8.4
- TI-2026-20305 melange affected by potential host command execution via license-check YAML mode patch pipeline CVSS 3.1HIGH 7.8
- TI-2026-23195 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses CVSS 3.1MEDIUM 6.1
- TI-2026-20307 melange has a path traversal in license-path which allows reading files outside workspace CVSS 3.1MEDIUM 5.5
- TI-2026-23196 melange has Path Traversal via .PKGINFO in --persist-lint-results CVSS 3.1MEDIUM 4.4
Sources
- CVE-2026-29049 · CVE Program
- CVE-2026-29049 · NVD
- FIRST EPSS
- GHSA-7rp8-r62p-q6wc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences