En resumen
- CVE-2026-29049 es una vulnerabilidad MEDIO (CVSS 4.3) que afecta a chainguard.dev/melange, melange (chainguard).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.26%, mayor que el 18.1% de las vulnerabilidades.
- Solución: actualizar a 0.43.4 o posterior.
Description
melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.
Fix: Merged
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting this issue.
NVD description
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
Más vulnerabilidades de chainguard.dev/melange
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free