CVE-2026-29049: 
NixOS vulnerability analysis and mitigation

CVE-2026-29049 is an uncontrolled resource consumption vulnerability in Chainguard's melange, a tool for building APK packages using declarative pipelines. The flaw exists in the melange update-cache function, which downloads URIs from build configurations via io.Copy without any size limit or HTTP client timeout, allowing an attacker-controlled URI to cause unbounded disk writes and exhaust storage on the build runner. All versions up to and including 0.40.5 are affected. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-918 (Server-Side Request Forgery), located in pkg/renovate/cache/cache.go. When melange update-cache processes a build configuration, it fetches remote URIs using Go's io.Copy with no enforced download size cap or HTTP client timeout, meaning a response of arbitrary size will be written entirely to disk. An attacker who can influence a melange configuration file — for example, by contributing to an open-source project that uses melange — can supply a URI pointing to an infinitely large or very large resource, triggering disk exhaustion on the CI/CD build runner. The vulnerability was discovered and reported by Oleh Konko from 1seal (GitHub Advisory).

Successful exploitation results in a denial-of-service condition through disk space exhaustion on the build runner, disrupting build and CI/CD pipeline operations. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Affected build infrastructure may become entirely unavailable until disk space is recovered, potentially delaying software releases or blocking security patches from being built and distributed (GitHub Advisory, Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.034%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction in the form of a maintainer or automated pipeline processing a malicious melange configuration file (GitHub Advisory).

1. Identify a target: Locate an organization or project that uses melange (version ≤ 0.40.5) with melange update-cache as part of their CI/CD pipeline.
2. Craft a malicious configuration: Create or modify a melange build configuration file to include an attacker-controlled URI — for example, a URI pointing to a server that streams an infinitely large response (e.g., /dev/zero served over HTTP).
3. Introduce the configuration: Submit the malicious configuration via a pull request to an open-source project, a dependency update, or any other mechanism by which the target pipeline ingests melange configs.
4. Trigger update-cache: Wait for or induce the target's CI/CD system to run melange update-cache against the malicious configuration.
5. Disk exhaustion: The io.Copy call in pkg/renovate/cache/cache.go writes the unbounded HTTP response to disk without limit, filling the build runner's storage and causing the build process and potentially other services on the runner to fail (GitHub Advisory).

• File System: Rapid and unexpected growth of disk usage in the melange cache directory (typically within the build runner's workspace); disk full errors (ENOSPC) appearing in build logs.
• Network: Outbound HTTP connections from the build runner to unusual or external URIs specified in melange configuration files; long-lived HTTP connections with large or unbounded data transfers.
• Logs: Build runner logs showing melange update-cache commands followed by disk space errors or process failures; CI/CD pipeline failures with messages indicating insufficient disk space.
• Process: The melange process consuming disk I/O at an abnormally high rate for an extended period during the update-cache step (GitHub Advisory).

Users should upgrade melange to a version newer than 0.40.5, where a fix has been merged (patch details available in the GitHub security advisory). As interim workarounds, organizations should restrict the sources of melange configuration files to trusted, reviewed inputs and avoid processing untrusted or externally contributed configs with update-cache. Additionally, implementing disk quotas and monitoring on build runners can help detect and limit the impact of excessive disk write operations. Qualys scanner (detection ID 761789) can be used to identify vulnerable melange installations (GitHub Advisory, Red Hat CVE).

The vulnerability was published by antitree via the GitHub Security Advisory on March 2, 2026, with credit to Oleh Konko from 1seal for discovery and responsible disclosure. OpenSUSE issued a security announcement referencing the CVE in April 2026. Coverage has been limited to automated vulnerability tracking platforms and security feeds, with no notable broader media or researcher commentary identified (GitHub Advisory, OpenSUSE).