CVE-2026-29049
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Melange version 0.40.5 and earlier downloads URIs from build configs using io.Copy without any size limit or HTTP client timeout. An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk space on the build runner.
Risk Assessment
The risk is a denial-of-service attack via disk exhaustion on the CI/CD server, potentially disrupting build processes and causing infrastructure failure.
Recommendation
Upgrade melange to version 0.43.4 or later, which includes a patch that limits download size and sets an HTTP connection timeout.
Other vulnerabilities in melange
See all- CVE-2026-29051Medium
melange versions 0.32.0 through before 0.43.4 construct output file paths in --persist-lint-results by joining --out-dir with arch and pkgname from the APK's .PKGINFO without validating path separators or '..' sequences. An attacker supplying an APK to a melange lint/build pipeline could cause a JSON lint report to be written to an arbitrary reachable path. There is no direct code execution, but other JSON artifacts can be clobbered. The issue is fixed in 0.43.4.
- CVE-2026-29050Medium
melange (a tool for building apk packages using declarative pipelines) from version 0.32.0 to before 0.43.4 allows an attacker who can influence a melange configuration file to set pipeline[].uses to a value containing ../ sequences or an absolute path. The (*Compiled).compilePipeline function in pkg/build/compile.go passed uses directly to filepath.Join(pipelineDir, uses + ".yaml") without validation, so the resolved path could escape --pipeline-dir and read any YAML-parseable file visible to the melange process. Because the loaded file is interpreted as a melange pipeline and its runs: block is executed via /bin/sh -c in the build sandbox, this allowed shell commands from an out-of-tree file to run during the build, bypassing review. Fixed in melange v0.43.4 (commit 5829ca4).
Original NVD description (English source)
melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS