En bref
- CVE-2026-29049 est une vulnérabilité MOYENNE (CVSS 4.3) touchant chainguard.dev/melange, melange (chainguard).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.26%, plus élevée que 18.2% des vulnérabilités.
- Correctif : mettre à jour vers 0.43.4 ou plus récent.
Description
melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.
Fix: Merged
Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting this issue.
NVD description
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
Autres vulnérabilités de chainguard.dev/melange
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free