CVE-2026-29049

CVE-2026-29049 affects melange versions 0.40.5 and prior, where the 'update-cache' function downloads build config URIs without size limits or HTTP client timeouts. This allows an attacker to craft a malicious URI in a melange config, leading to unbounded disk writes and potential denial of service by exhausting disk space on the build runner. The vulnerability has a CVSS score of 4.3 (MEDIUM), indicating a network-based attack with low complexity, requiring user interaction (UI:R) to trigger, and resulting in low availability impact (A:L) without affecting confidentiality or integrity. There is currently no known patch available, and no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage has been observed for this CVE.