CVE-2026-29049

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.

• CWE-400
• CWE-918

• https://github.com/chainguard-dev/melange/commit/652ca5af08588f78e2d405e64b058fac8398d23f
• https://github.com/chainguard-dev/melange/pull/2379
• https://github.com/chainguard-dev/melange/releases/tag/v0.43.4
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wcVendor Advisory

Published

Mar 6, 2026

Last Modified

Jul 7, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29043HDF5 is software for managing data. In 1.14.1-2 and earlier,…5.5
• CVE-2026-29044EVerest is an EV charging software stack. Prior to version 2…6.5
• CVE-2026-29045Hono is a Web application framework that provides support fo…9.8
• CVE-2026-29046TinyWeb is a web server (HTTP, HTTPS) written in Delphi for …8.2
• CVE-2026-29047GLPI is a free asset and IT management software package. Fro…8.8
• CVE-2026-29048HumHub is an Open Source Enterprise Social Network. In versi…6.1
• CVE-2026-2905A vulnerability was identified in Tenda HG9 300001138. This …8.8
• CVE-2026-29050melange allows users to build apk packages using declarative…6.1
• CVE-2026-29051melange allows users to build apk packages using declarative…3.3
• CVE-2026-29052The Calendar module for HumHub enables users to create one-t…6.1
• CVE-2026-29053Ghost is a Node.js content management system. From version 0…9.8
• CVE-2026-29054Traefik is an HTTP reverse proxy and load balancer. From ver…7.5