4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-29049

CVE-2026-29049: melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-29049

CVE-2026-29049:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/melange	go	<= 0.40.5

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unbounded HTTP download in melange update-cache. The advisory mentions the vulnerable code is in pkg/renovate/cache/cache.go and the function io.Copy is used without size limits. The path in the advisory was slightly incorrect, the actual path is pkg/cache/cache.go. I was able to find the fixing commit by searching for commits that modify this file and introduce a size limit for downloads. The commit b6145148324a3557a95642a9973c7992813a9443 replaces io.Copy with io.CopyN in the fetch function in pkg/cache/cache.go. This function is responsible for downloading files. The lack of a size limit in the original implementation is the root cause of the vulnerability. Therefore, the fetch function is the vulnerable function.

Vulnerable functions

cache.fetch

pkg/cache/cache.go

The function `fetch` in `pkg/cache/cache.go` was vulnerable to uncontrolled resource consumption. It used `io.Copy` to download content from a URI without any size limit. An attacker could provide a malicious URI in a melange configuration, causing the function to download an excessively large file, leading to disk exhaustion on the build runner. The patch fixes this by replacing `io.Copy` with `io.CopyN`, which limits the download size to 10MB.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.