CVE-2026-29049

MEDIUM4.3EPSS 0.05%

`melange update-cache` has unbounded HTTP download that can exhaust disk in CI

發布日:2026/3/2修改日:2026/3/23

也稱為:GHSA-7rp8-r62p-q6wcGO-2026-4588

描述

`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5. **Fix:** Merged **Acknowledgements** melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.

受影響套件(2)

Go/chainguard.dev/melangefrom 0, <= 0.40.5
Go/chainguard.dev/melangefrom 0

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

參考連結(3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-29049
PATCHhttps://github.com/chainguard-dev/melange
WEBhttps://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc