CVE-2026-29049

Description

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-400: Uncontrolled Resource Consumption

CWE-918: Server-Side Request Forgery (SSRF)

Product status

References

github.com/...elange/security/advisories/GHSA-7rp8-r62p-q6wc

cve.org (CVE-2026-29049)

nvd.nist.gov (CVE-2026-29049)

Download JSON