GitHub Advisoryadvisory · Go

GHSA-7rp8-r62p-q6wc `melange update-cache` has unbounded HTTP download that can exhaust disk in CI

MEDIUM Published 2026-03-02 Modified 2026-07-07 Official page ↗
Aliases
CVE-2026-29049
Ecosystem
Go
Packages
chainguard.dev/melange
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-918
Reviewed
2026-03-02

Affected packages

• Go chainguard.dev/melange: < 0.43.4 → fixed in 0.43.4

Description

`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5. Fix: Merged Acknowledgements Thank you to Oleh Konko from 1seal for discovering and reporting this issue.

Related

Alias · CVE (1)

  • CVE-2026-29049 melange allows users to build apk packages using declarative pipelines. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-918 Server-Side Request Forgery weakness

References