Go/chainguard.dev/melange CVE-2026-29049: medium 4.3, EPSS 0.42%
`melange update-cache` has unbounded HTTP download that can exhaust disk in CI
Action: Upgrade chainguard.dev/melange to 0.43.4 or later.
go get chainguard.dev/melange@v0.43.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.43.4 | - |
Fixed versions
| 0.43.4 |
Sources
- osv: GHSA-7rp8-r62p-q6wc
- https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc
- https://nvd.nist.gov/vuln/detail/CVE-2026-29049
- https://github.com/chainguard-dev/melange/pull/2379
- https://github.com/chainguard-dev/melange/commit/652ca5af08588f78e2d405e64b058fac8398d23f
- https://github.com/chainguard-dev/melange
- https://github.com/chainguard-dev/melange/releases/tag/v0.43.4
CVE-2026-29049 · published · modified · JSON