Executive brief
Melange, a tool used to build software packages, contains a flaw in how it handles file downloads during the build process. An attacker who can influence a build configuration file can force the system to download massive amounts of data without limits. This can lead to the build server running out of disk space, causing build failures and disrupting software delivery pipelines.
Technical details
The melange 'update-cache' command fails to implement size limits or HTTP timeouts when downloading URIs defined in build configurations. Specifically, in 'pkg/renovate/cache/cache.go', the application uses 'io.Copy' to fetch remote resources without validation. An attacker-controlled URI in a melange configuration can trigger unbounded disk writes, leading to a Denial of Service (DoS) by exhausting the disk space of the build runner. This vulnerability also exhibits Server-Side Request Forgery (SSRF) characteristics as the runner fetches arbitrary attacker-supplied URLs. The issue is addressed in version 0.43.4.
Affected products
- chainguard-dev melange < 0.43.4
Timeline
- 2026-03-02: advisory: GitHub Security Advisory GHSA-7rp8-r62p-q6wc published
- 2026-03-06: disclosed: CVE-2026-29049 published to NVD
- 2026-02-28: patched: Version 0.43.4 released with fix