CVE-2026-29049

Katalog CVE

CVSS 4.3 · Medium EPSS 0,41%

Kerentanan Uncontrolled Resource Consumption pada chainguard melange. Skor CVSS 3.1 4.3 (Medium) menurut github.com.

Deskripsi (NVD)

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.

Rincian

Terbit di NVD

6 Maret 2026

Terakhir diubah

7 Juli 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,41% peluang dieksploitasi; lebih tinggi dari 33,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc advisory vendor
• https://github.com/chainguard-dev/melange/commit/652ca5af08588f78e2d405e64b058fac8398d23f
• https://github.com/chainguard-dev/melange/pull/2379
• https://github.com/chainguard-dev/melange/releases/tag/v0.43.4