PT-2026-23003 · Melange · Melange

1Seal · Publicado 2026-03-02 · Atualizado 2026-03-25 · CVE-2026-29049

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions melange versions prior to 0.40.5

Description melange enables users to create apk packages using declarative pipelines. In versions 0.40.5 and earlier, the melange update-cache function downloads URIs from build configurations using io.Copy without any size limitations or HTTP client timeouts. An attacker-controlled URI within a melange configuration can lead to unrestricted disk writes, potentially exhausting disk space on the build runner. The vulnerable code is located in pkg/renovate/cache/cache.go.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Resource Exhaustion

Enumeração de Fraquezas

CWE-918

CWE-400

Identificadores relacionados

CVE-2026-29049

GHSA-7RP8-R62P-Q6WC

GO-2026-4588

SUSE-SU-2026:1042-1

Produtos afetados

Melange

Referências · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29049.json · Exploit
• https://github.com/chainguard-dev/melange · Nota
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-29192 · Nota
• https://suse.com/security/cve/CVE-2026-32245 · Nota
• https://suse.com/security/cve/CVE-2026-30869 · Nota
• https://suse.com/security/cve/CVE-2026-32136 · Nota
• https://suse.com/security/cve/CVE-2026-27969 · Nota
• https://suse.com/security/cve/CVE-2026-32614 · Nota
• https://suse.com/security/cve/CVE-2026-27575 · Nota
• https://suse.com/security/cve/CVE-2026-26999 · Nota
• https://suse.com/security/cve/CVE-2025-62879 · Nota
• https://suse.com/security/cve/CVE-2026-26196 · Nota
• https://suse.com/security/cve/CVE-2026-27899 · Nota
• https://suse.com/security/cve/CVE-2026-28790 · Nota