CVE-2026-29049
MEDIUM4.3EPSS 0.05%`melange update-cache` has unbounded HTTP download that can exhaust disk in CI
Published: 3/2/2026Modified: 3/23/2026
Description
`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5. **Fix:** Merged **Acknowledgements** melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
Affected packages (2)
- Go/chainguard.dev/melangefrom 0, <= 0.40.5
- Go/chainguard.dev/melangefrom 0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L |