PT-2026-23003 · Melange · Melange

1Seal · Published 2026-03-02 · Updated 2026-03-25 · CVE-2026-29049

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions melange versions prior to 0.40.5

Description melange enables users to create apk packages using declarative pipelines. In versions 0.40.5 and earlier, the melange update-cache function downloads URIs from build configurations using io.Copy without any size limitations or HTTP client timeouts. An attacker-controlled URI within a melange configuration can lead to unrestricted disk writes, potentially exhausting disk space on the build runner. The vulnerable code is located in pkg/renovate/cache/cache.go.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Resource Exhaustion

Weakness Enumeration

CWE-918

CWE-400

Related Identifiers

CVE-2026-29049

GHSA-7RP8-R62P-Q6WC

GO-2026-4588

SUSE-SU-2026:1042-1

Affected Products

Melange

References · 136

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29049.json · Exploit
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-29049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29049 · Security Note
• https://osv.dev/vulnerability/GO-2026-4588 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rp8-r62p-q6wc · Vendor Advisory
• https://github.com/chainguard-dev/melange · Note
• https://suse.com/security/cve/CVE-2026-29192 · Note
• https://suse.com/security/cve/CVE-2026-32245 · Note
• https://suse.com/security/cve/CVE-2026-30869 · Note
• https://suse.com/security/cve/CVE-2026-32136 · Note
• https://suse.com/security/cve/CVE-2026-27969 · Note
• https://suse.com/security/cve/CVE-2026-32614 · Note
• https://suse.com/security/cve/CVE-2026-27575 · Note