CVE-2026-29049 melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI
An attacker can exhaust disk space on CI build runners by providing a malicious URI in melange build configs, causing unbounded downloads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-29049?
CVE-2026-29049 is a medium-severity denial of service vulnerability in chainguard-dev melange, published on 6 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
Which versions are affected by CVE-2026-29049?
3 open source packages ship an affected version, including chainguard.dev/melange. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
chainguard.dev/melange Go | All versions | None |
chainguard.dev/melange Go | All versions | 0.43.4 |
chainguard.dev/melange Go | All versions | 0.43.4 |
Products include Chainguard Melange.
How do I fix CVE-2026-29049?
Upgrade chainguard.dev/melange to 0.43.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-29049 being exploited?
There is no known exploitation of CVE-2026-29049 in the wild and no public exploit code.
Other vulnerabilities in chainguard-dev melange
- CVE-2026-24843 melange QEMU runner could write files outside workspace directory
- CVE-2026-24844 melange pipeline working-directory could allow command injection
- CVE-2026-25143 melange affected by potential host command execution via license-check YAML mode patch pipeline
- CVE-2026-29050 melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses
- CVE-2026-25145 melange has a path traversal in license-path which allows reading files outside workspace
Sources
Also known as GHSA-7rp8-r62p-q6wc, GO-2026-4588.