{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-29049", "tracking": { "current_release_date": "2026-04-01T18:47:56.023120Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-29049", "initial_release_date": "2026-03-04T02:39:43.160152Z", "revision_history": [ { "date": "2026-03-04T02:39:43.160152Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-03-04T02:39:47.685632Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-03-04T18:12:44.965646Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-04T18:12:52.549664Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-03-06T07:25:14.009328Z", "number": "5", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (1).| CWES updated (1)." }, { "date": "2026-03-06T07:25:19.497076Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-03-06T07:39:47.159274Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (1).| CWES updated (1)." }, { "date": "2026-03-06T07:39:55.227338Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-03-06T14:52:25.804837Z", "number": "9", "summary": "Source created.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-06T14:52:31.219816Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-03-06T22:39:53.434057Z", "number": "11", "summary": "References created (1)." }, { "date": "2026-03-07T00:12:57.811850Z", "number": "12", "summary": "References created (1)." }, { "date": "2026-03-09T20:39:21.456052Z", "number": "13", "summary": "Unknown change." }, { "date": "2026-03-09T20:39:23.409908Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-03-10T21:26:20.323257Z", "number": "15", "summary": "Products created (1).| Product Identifiers created (1)." }, { "date": "2026-03-10T21:26:23.145404Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-03-20T09:35:49.800655Z", "number": "17", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-03-20T09:35:54.062166Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-03-25T18:14:59.903215Z", "number": "19", "summary": "Source created.| CVE status created. (valid)| Description created for source.| References created (1)." }, { "date": "2026-03-25T18:15:02.044864Z", "number": "20", "summary": "NCSC Score updated." }, { "date": "2026-03-25T19:03:05.881705Z", "number": "21", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (197).| Products created (3).| References created (3).| CWES updated (1)." }, { "date": "2026-03-27T08:08:18.070465Z", "number": "22", "summary": "NCSC Score updated." }, { "date": "2026-04-01T18:47:54.117891Z", "number": "23", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| References created (4).| CWES updated (1)." } ], "status": "interim", "version": "23" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<=0.40.5", "product": { "name": "vers:unknown/<=0.40.5", "product_id": "CSAFPID-5982411" } } ], "category": "product_name", "name": "go/chainguard.dev/melange" } ], "category": "vendor", "name": "chainguard.dev" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<=0.40.5", "product": { "name": "vers:unknown/<=0.40.5", "product_id": "CSAFPID-5778685", "product_identification_helper": { "cpe": "cpe:2.3:a:chainguard:melange:*:*:*:*:*:go:*:*" } } } ], "category": "product_name", "name": "melange" } ], "category": "vendor", "name": "chainguard" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<=0.40.5", "product": { "name": "vers:unknown/<=0.40.5", "product_id": "CSAFPID-5765484" } }, { "category": "product_version_range", "name": "vers:unknown/>=0|<=0.40.5", "product": { "name": "vers:unknown/>=0|<=0.40.5", "product_id": "CSAFPID-5758947" } }, { "category": "product_version_range", "name": "vers:unknown/v0.1.0", "product": { "name": "vers:unknown/v0.1.0", "product_id": "CSAFPID-3750849" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.0", "product": { "name": "vers:unknown/v0.10.0", "product_id": "CSAFPID-3750850" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.1", "product": { "name": "vers:unknown/v0.10.1", "product_id": "CSAFPID-3750851" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.2", "product": { "name": "vers:unknown/v0.10.2", "product_id": "CSAFPID-3750852" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.3", "product": { "name": "vers:unknown/v0.10.3", "product_id": "CSAFPID-3750853" } }, { "category": "product_version_range", "name": "vers:unknown/v0.10.4", "product": { "name": "vers:unknown/v0.10.4", "product_id": "CSAFPID-3750854" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.0", "product": { "name": "vers:unknown/v0.11.0", "product_id": "CSAFPID-3750855" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.1", "product": { "name": "vers:unknown/v0.11.1", "product_id": "CSAFPID-3750856" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.2", "product": { "name": "vers:unknown/v0.11.2", "product_id": "CSAFPID-3750857" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.3", "product": { "name": "vers:unknown/v0.11.3", "product_id": "CSAFPID-3750858" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.4", "product": { "name": "vers:unknown/v0.11.4", "product_id": "CSAFPID-3750859" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.5", "product": { "name": "vers:unknown/v0.11.5", "product_id": "CSAFPID-3750860" } }, { "category": "product_version_range", "name": "vers:unknown/v0.11.6", "product": { "name": "vers:unknown/v0.11.6", "product_id": "CSAFPID-3750861" } }, { "category": "product_version_range", "name": "vers:unknown/v0.12.0", "product": { "name": "vers:unknown/v0.12.0", "product_id": "CSAFPID-3750862" } }, { "category": "product_version_range", "name": "vers:unknown/v0.12.1", "product": { "name": "vers:unknown/v0.12.1", "product_id": "CSAFPID-3750863" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.0", "product": { "name": "vers:unknown/v0.13.0", "product_id": "CSAFPID-3750864" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.1", "product": { "name": "vers:unknown/v0.13.1", "product_id": "CSAFPID-3750865" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.2", "product": { "name": "vers:unknown/v0.13.2", "product_id": "CSAFPID-3750866" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.3", "product": { "name": "vers:unknown/v0.13.3", "product_id": "CSAFPID-3750867" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.4", "product": { "name": "vers:unknown/v0.13.4", "product_id": "CSAFPID-3750868" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.5", "product": { "name": "vers:unknown/v0.13.5", "product_id": "CSAFPID-3750869" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.6", "product": { "name": "vers:unknown/v0.13.6", "product_id": "CSAFPID-3750870" } }, { "category": "product_version_range", "name": "vers:unknown/v0.13.7", "product": { "name": "vers:unknown/v0.13.7", "product_id": "CSAFPID-3750871" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.0", "product": { "name": "vers:unknown/v0.14.0", "product_id": "CSAFPID-3750872" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.1", "product": { "name": "vers:unknown/v0.14.1", "product_id": "CSAFPID-3750873" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.10", "product": { "name": "vers:unknown/v0.14.10", "product_id": "CSAFPID-3750874" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.11", "product": { "name": "vers:unknown/v0.14.11", "product_id": "CSAFPID-3750875" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.2", "product": { "name": "vers:unknown/v0.14.2", "product_id": "CSAFPID-3750876" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.3", "product": { "name": "vers:unknown/v0.14.3", "product_id": "CSAFPID-3750877" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.4", "product": { "name": "vers:unknown/v0.14.4", "product_id": "CSAFPID-3750878" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.5", "product": { "name": "vers:unknown/v0.14.5", "product_id": "CSAFPID-3750879" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.6", "product": { "name": "vers:unknown/v0.14.6", "product_id": "CSAFPID-3750880" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.7", "product": { "name": "vers:unknown/v0.14.7", "product_id": "CSAFPID-3750881" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.8", "product": { "name": "vers:unknown/v0.14.8", "product_id": "CSAFPID-3750882" } }, { "category": "product_version_range", "name": "vers:unknown/v0.14.9", "product": { "name": "vers:unknown/v0.14.9", "product_id": "CSAFPID-3750883" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.0", "product": { "name": "vers:unknown/v0.15.0", "product_id": "CSAFPID-3750884" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.1", "product": { "name": "vers:unknown/v0.15.1", "product_id": "CSAFPID-3750885" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.10", "product": { "name": "vers:unknown/v0.15.10", "product_id": "CSAFPID-3750886" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.11", "product": { "name": "vers:unknown/v0.15.11", "product_id": "CSAFPID-3750887" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.12", "product": { "name": "vers:unknown/v0.15.12", "product_id": "CSAFPID-3750888" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.13", "product": { "name": "vers:unknown/v0.15.13", "product_id": "CSAFPID-3750889" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.14", "product": { "name": "vers:unknown/v0.15.14", "product_id": "CSAFPID-3750890" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.2", "product": { "name": "vers:unknown/v0.15.2", "product_id": "CSAFPID-3750891" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.3", "product": { "name": "vers:unknown/v0.15.3", "product_id": "CSAFPID-3750892" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.4", "product": { "name": "vers:unknown/v0.15.4", "product_id": "CSAFPID-3750893" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.5", "product": { "name": "vers:unknown/v0.15.5", "product_id": "CSAFPID-3750894" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.6", "product": { "name": "vers:unknown/v0.15.6", "product_id": "CSAFPID-3750895" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.7", "product": { "name": "vers:unknown/v0.15.7", "product_id": "CSAFPID-3750896" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.8", "product": { "name": "vers:unknown/v0.15.8", "product_id": "CSAFPID-3750897" } }, { "category": "product_version_range", "name": "vers:unknown/v0.15.9", "product": { "name": "vers:unknown/v0.15.9", "product_id": "CSAFPID-3750898" } }, { "category": "product_version_range", "name": "vers:unknown/v0.16.0", "product": { "name": "vers:unknown/v0.16.0", "product_id": "CSAFPID-3750899" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.0", "product": { "name": "vers:unknown/v0.17.0", "product_id": "CSAFPID-3750900" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.1", "product": { "name": "vers:unknown/v0.17.1", "product_id": "CSAFPID-3750901" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.2", "product": { "name": "vers:unknown/v0.17.2", "product_id": "CSAFPID-3750902" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.3", "product": { "name": "vers:unknown/v0.17.3", "product_id": "CSAFPID-3750903" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.4", "product": { "name": "vers:unknown/v0.17.4", "product_id": "CSAFPID-3750904" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.5", "product": { "name": "vers:unknown/v0.17.5", "product_id": "CSAFPID-3750905" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.6", "product": { "name": "vers:unknown/v0.17.6", "product_id": "CSAFPID-3750906" } }, { "category": "product_version_range", "name": "vers:unknown/v0.17.7", "product": { "name": "vers:unknown/v0.17.7", "product_id": "CSAFPID-3750907" } }, { "category": "product_version_range", "name": "vers:unknown/v0.18.0", "product": { "name": "vers:unknown/v0.18.0", "product_id": "CSAFPID-3750908" } }, { "category": "product_version_range", "name": "vers:unknown/v0.18.1", "product": { "name": "vers:unknown/v0.18.1", "product_id": "CSAFPID-3750909" } }, { "category": "product_version_range", "name": "vers:unknown/v0.18.2", "product": { "name": "vers:unknown/v0.18.2", "product_id": "CSAFPID-3750910" } }, { "category": "product_version_range", "name": "vers:unknown/v0.18.3", "product": { "name": "vers:unknown/v0.18.3", "product_id": "CSAFPID-3750911" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.0", "product": { "name": "vers:unknown/v0.19.0", "product_id": "CSAFPID-3750912" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.1", "product": { "name": "vers:unknown/v0.19.1", "product_id": "CSAFPID-3750913" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.2", "product": { "name": "vers:unknown/v0.19.2", "product_id": "CSAFPID-3750914" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.3", "product": { "name": "vers:unknown/v0.19.3", "product_id": "CSAFPID-3750915" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.4", "product": { "name": "vers:unknown/v0.19.4", "product_id": "CSAFPID-3750916" } }, { "category": "product_version_range", "name": "vers:unknown/v0.19.5", "product": { "name": "vers:unknown/v0.19.5", "product_id": "CSAFPID-3750917" } }, { "category": "product_version_range", "name": "vers:unknown/v0.2.0", "product": { "name": "vers:unknown/v0.2.0", "product_id": "CSAFPID-3750918" } }, { "category": "product_version_range", "name": "vers:unknown/v0.20.0", "product": { "name": "vers:unknown/v0.20.0", "product_id": "CSAFPID-3750919" } }, { "category": "product_version_range", "name": "vers:unknown/v0.20.1", "product": { "name": "vers:unknown/v0.20.1", "product_id": "CSAFPID-3750920" } }, { "category": "product_version_range", "name": "vers:unknown/v0.21.0", "product": { "name": "vers:unknown/v0.21.0", "product_id": "CSAFPID-3750921" } }, { "category": "product_version_range", "name": "vers:unknown/v0.21.1", "product": { "name": "vers:unknown/v0.21.1", "product_id": "CSAFPID-3750922" } }, { "category": "product_version_range", "name": "vers:unknown/v0.21.2", "product": { "name": "vers:unknown/v0.21.2", "product_id": "CSAFPID-3750923" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.0", "product": { "name": "vers:unknown/v0.22.0", "product_id": "CSAFPID-3750924" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.1", "product": { "name": "vers:unknown/v0.22.1", "product_id": "CSAFPID-3750925" } }, { "category": "product_version_range", "name": "vers:unknown/v0.22.2", "product": { "name": "vers:unknown/v0.22.2", "product_id": "CSAFPID-3750926" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.0", "product": { "name": "vers:unknown/v0.23.0", "product_id": "CSAFPID-5082332" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.1", "product": { "name": "vers:unknown/v0.23.1", "product_id": "CSAFPID-5082333" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.10", "product": { "name": "vers:unknown/v0.23.10", "product_id": "CSAFPID-5082334" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.11", "product": { "name": "vers:unknown/v0.23.11", "product_id": "CSAFPID-5082335" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.12", "product": { "name": "vers:unknown/v0.23.12", "product_id": "CSAFPID-5082336" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.13", "product": { "name": "vers:unknown/v0.23.13", "product_id": "CSAFPID-5082337" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.14", "product": { "name": "vers:unknown/v0.23.14", "product_id": "CSAFPID-5082338" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.15", "product": { "name": "vers:unknown/v0.23.15", "product_id": "CSAFPID-5082339" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.16", "product": { "name": "vers:unknown/v0.23.16", "product_id": "CSAFPID-5082340" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.17", "product": { "name": "vers:unknown/v0.23.17", "product_id": "CSAFPID-5082341" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.2", "product": { "name": "vers:unknown/v0.23.2", "product_id": "CSAFPID-5082342" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.3", "product": { "name": "vers:unknown/v0.23.3", "product_id": "CSAFPID-5082343" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.4", "product": { "name": "vers:unknown/v0.23.4", "product_id": "CSAFPID-5082344" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.5", "product": { "name": "vers:unknown/v0.23.5", "product_id": "CSAFPID-5082345" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.6", "product": { "name": "vers:unknown/v0.23.6", "product_id": "CSAFPID-5082346" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.7", "product": { "name": "vers:unknown/v0.23.7", "product_id": "CSAFPID-5082347" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.8", "product": { "name": "vers:unknown/v0.23.8", "product_id": "CSAFPID-5082348" } }, { "category": "product_version_range", "name": "vers:unknown/v0.23.9", "product": { "name": "vers:unknown/v0.23.9", "product_id": "CSAFPID-5082349" } }, { "category": "product_version_range", "name": "vers:unknown/v0.24.0", "product": { "name": "vers:unknown/v0.24.0", "product_id": "CSAFPID-5082350" } }, { "category": "product_version_range", "name": "vers:unknown/v0.25.0", "product": { "name": "vers:unknown/v0.25.0", "product_id": "CSAFPID-5082351" } }, { "category": "product_version_range", "name": "vers:unknown/v0.25.1", "product": { "name": "vers:unknown/v0.25.1", "product_id": "CSAFPID-5082352" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.0", "product": { "name": "vers:unknown/v0.26.0", "product_id": "CSAFPID-5082353" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.1", "product": { "name": "vers:unknown/v0.26.1", "product_id": "CSAFPID-5082354" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.10", "product": { "name": "vers:unknown/v0.26.10", "product_id": "CSAFPID-5082355" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.11", "product": { "name": "vers:unknown/v0.26.11", "product_id": "CSAFPID-5082356" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.12", "product": { "name": "vers:unknown/v0.26.12", "product_id": "CSAFPID-5082357" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.13", "product": { "name": "vers:unknown/v0.26.13", "product_id": "CSAFPID-5082358" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.2", "product": { "name": "vers:unknown/v0.26.2", "product_id": "CSAFPID-5082359" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.3", "product": { "name": "vers:unknown/v0.26.3", "product_id": "CSAFPID-5082360" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.4", "product": { "name": "vers:unknown/v0.26.4", "product_id": "CSAFPID-5082361" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.5", "product": { "name": "vers:unknown/v0.26.5", "product_id": "CSAFPID-5082362" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.6", "product": { "name": "vers:unknown/v0.26.6", "product_id": "CSAFPID-5082363" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.7", "product": { "name": "vers:unknown/v0.26.7", "product_id": "CSAFPID-5082364" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.8", "product": { "name": "vers:unknown/v0.26.8", "product_id": "CSAFPID-5082365" } }, { "category": "product_version_range", "name": "vers:unknown/v0.26.9", "product": { "name": "vers:unknown/v0.26.9", "product_id": "CSAFPID-5082366" } }, { "category": "product_version_range", "name": "vers:unknown/v0.27.0", "product": { "name": "vers:unknown/v0.27.0", "product_id": "CSAFPID-5082367" } }, { "category": "product_version_range", "name": "vers:unknown/v0.28.0", "product": { "name": "vers:unknown/v0.28.0", "product_id": "CSAFPID-5082368" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.0", "product": { "name": "vers:unknown/v0.29.0", "product_id": "CSAFPID-5082369" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.1", "product": { "name": "vers:unknown/v0.29.1", "product_id": "CSAFPID-5082370" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.2", "product": { "name": "vers:unknown/v0.29.2", "product_id": "CSAFPID-5082371" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.3", "product": { "name": "vers:unknown/v0.29.3", "product_id": "CSAFPID-5082372" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.4", "product": { "name": "vers:unknown/v0.29.4", "product_id": "CSAFPID-5082373" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.5", "product": { "name": "vers:unknown/v0.29.5", "product_id": "CSAFPID-5559121" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.6", "product": { "name": "vers:unknown/v0.29.6", "product_id": "CSAFPID-5559122" } }, { "category": "product_version_range", "name": "vers:unknown/v0.29.7", "product": { "name": "vers:unknown/v0.29.7", "product_id": "CSAFPID-5559123" } }, { "category": "product_version_range", "name": "vers:unknown/v0.3.0", "product": { "name": "vers:unknown/v0.3.0", "product_id": "CSAFPID-3750927" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.0", "product": { "name": "vers:unknown/v0.30.0", "product_id": "CSAFPID-5559124" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.1", "product": { "name": "vers:unknown/v0.30.1", "product_id": "CSAFPID-5559125" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.2", "product": { "name": "vers:unknown/v0.30.2", "product_id": "CSAFPID-5559126" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.3", "product": { "name": "vers:unknown/v0.30.3", "product_id": "CSAFPID-5559127" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.4", "product": { "name": "vers:unknown/v0.30.4", "product_id": "CSAFPID-5559128" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.5", "product": { "name": "vers:unknown/v0.30.5", "product_id": "CSAFPID-5559129" } }, { "category": "product_version_range", "name": "vers:unknown/v0.30.6", "product": { "name": "vers:unknown/v0.30.6", "product_id": "CSAFPID-5559130" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.0", "product": { "name": "vers:unknown/v0.31.0", "product_id": "CSAFPID-5559131" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.1", "product": { "name": "vers:unknown/v0.31.1", "product_id": "CSAFPID-5559132" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.2", "product": { "name": "vers:unknown/v0.31.2", "product_id": "CSAFPID-5559133" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.3", "product": { "name": "vers:unknown/v0.31.3", "product_id": "CSAFPID-5559134" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.4", "product": { "name": "vers:unknown/v0.31.4", "product_id": "CSAFPID-5559135" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.5", "product": { "name": "vers:unknown/v0.31.5", "product_id": "CSAFPID-5559136" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.6", "product": { "name": "vers:unknown/v0.31.6", "product_id": "CSAFPID-5559137" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.7", "product": { "name": "vers:unknown/v0.31.7", "product_id": "CSAFPID-5559138" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.8", "product": { "name": "vers:unknown/v0.31.8", "product_id": "CSAFPID-5559139" } }, { "category": "product_version_range", "name": "vers:unknown/v0.31.9", "product": { "name": "vers:unknown/v0.31.9", "product_id": "CSAFPID-5559140" } }, { "category": "product_version_range", "name": "vers:unknown/v0.32.0", "product": { "name": "vers:unknown/v0.32.0", "product_id": "CSAFPID-5559141" } }, { "category": "product_version_range", "name": "vers:unknown/v0.33.0", "product": { "name": "vers:unknown/v0.33.0", "product_id": "CSAFPID-5559142" } }, { "category": "product_version_range", "name": "vers:unknown/v0.33.1", "product": { "name": "vers:unknown/v0.33.1", "product_id": "CSAFPID-5559143" } }, { "category": "product_version_range", "name": "vers:unknown/v0.33.2", "product": { "name": "vers:unknown/v0.33.2", "product_id": "CSAFPID-5559144" } }, { "category": "product_version_range", "name": "vers:unknown/v0.34.0", "product": { "name": "vers:unknown/v0.34.0", "product_id": "CSAFPID-5559145" } }, { "category": "product_version_range", "name": "vers:unknown/v0.34.1", "product": { "name": "vers:unknown/v0.34.1", "product_id": "CSAFPID-5559146" } }, { "category": "product_version_range", "name": "vers:unknown/v0.34.2", "product": { "name": "vers:unknown/v0.34.2", "product_id": "CSAFPID-5559147" } }, { "category": "product_version_range", "name": "vers:unknown/v0.34.3", "product": { "name": "vers:unknown/v0.34.3", "product_id": "CSAFPID-5559148" } }, { "category": "product_version_range", "name": "vers:unknown/v0.35.0", "product": { "name": "vers:unknown/v0.35.0", "product_id": "CSAFPID-5559149" } }, { "category": "product_version_range", "name": "vers:unknown/v0.35.1", "product": { "name": "vers:unknown/v0.35.1", "product_id": "CSAFPID-5559150" } }, { "category": "product_version_range", "name": "vers:unknown/v0.36.0", "product": { "name": "vers:unknown/v0.36.0", "product_id": "CSAFPID-5559151" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.0", "product": { "name": "vers:unknown/v0.37.0", "product_id": "CSAFPID-5559152" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.1", "product": { "name": "vers:unknown/v0.37.1", "product_id": "CSAFPID-5559153" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.2", "product": { "name": "vers:unknown/v0.37.2", "product_id": "CSAFPID-5559154" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.3", "product": { "name": "vers:unknown/v0.37.3", "product_id": "CSAFPID-5559155" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.4", "product": { "name": "vers:unknown/v0.37.4", "product_id": "CSAFPID-5559156" } }, { "category": "product_version_range", "name": "vers:unknown/v0.37.5", "product": { "name": "vers:unknown/v0.37.5", "product_id": "CSAFPID-5559157" } }, { "category": "product_version_range", "name": "vers:unknown/v0.38.0", "product": { "name": "vers:unknown/v0.38.0", "product_id": "CSAFPID-5559158" } }, { "category": "product_version_range", "name": "vers:unknown/v0.38.1", "product": { "name": "vers:unknown/v0.38.1", "product_id": "CSAFPID-5559159" } }, { "category": "product_version_range", "name": "vers:unknown/v0.39.0", "product": { "name": "vers:unknown/v0.39.0", "product_id": "CSAFPID-5559160" } }, { "category": "product_version_range", "name": "vers:unknown/v0.4.0", "product": { "name": "vers:unknown/v0.4.0", "product_id": "CSAFPID-3750928" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.0", "product": { "name": "vers:unknown/v0.40.0", "product_id": "CSAFPID-5559161" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.1", "product": { "name": "vers:unknown/v0.40.1", "product_id": "CSAFPID-5559162" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.2", "product": { "name": "vers:unknown/v0.40.2", "product_id": "CSAFPID-5559163" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.3", "product": { "name": "vers:unknown/v0.40.3", "product_id": "CSAFPID-5909026" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.4", "product": { "name": "vers:unknown/v0.40.4", "product_id": "CSAFPID-5909027" } }, { "category": "product_version_range", "name": "vers:unknown/v0.40.5", "product": { "name": "vers:unknown/v0.40.5", "product_id": "CSAFPID-5909028" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.0", "product": { "name": "vers:unknown/v0.5.0", "product_id": "CSAFPID-3750929" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.1", "product": { "name": "vers:unknown/v0.5.1", "product_id": "CSAFPID-3750930" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.10", "product": { "name": "vers:unknown/v0.5.10", "product_id": "CSAFPID-3750931" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.2", "product": { "name": "vers:unknown/v0.5.2", "product_id": "CSAFPID-3750932" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.3", "product": { "name": "vers:unknown/v0.5.3", "product_id": "CSAFPID-3750933" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.4", "product": { "name": "vers:unknown/v0.5.4", "product_id": "CSAFPID-3750934" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.5", "product": { "name": "vers:unknown/v0.5.5", "product_id": "CSAFPID-3750935" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.6", "product": { "name": "vers:unknown/v0.5.6", "product_id": "CSAFPID-3750936" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.7", "product": { "name": "vers:unknown/v0.5.7", "product_id": "CSAFPID-3750937" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.8", "product": { "name": "vers:unknown/v0.5.8", "product_id": "CSAFPID-3750938" } }, { "category": "product_version_range", "name": "vers:unknown/v0.5.9", "product": { "name": "vers:unknown/v0.5.9", "product_id": "CSAFPID-3750939" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.0", "product": { "name": "vers:unknown/v0.6.0", "product_id": "CSAFPID-3750940" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.1", "product": { "name": "vers:unknown/v0.6.1", "product_id": "CSAFPID-3750941" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.10", "product": { "name": "vers:unknown/v0.6.10", "product_id": "CSAFPID-3750942" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.11", "product": { "name": "vers:unknown/v0.6.11", "product_id": "CSAFPID-3750943" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.2", "product": { "name": "vers:unknown/v0.6.2", "product_id": "CSAFPID-3750944" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.3", "product": { "name": "vers:unknown/v0.6.3", "product_id": "CSAFPID-3750945" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.4", "product": { "name": "vers:unknown/v0.6.4", "product_id": "CSAFPID-3750946" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.5", "product": { "name": "vers:unknown/v0.6.5", "product_id": "CSAFPID-3750947" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.6", "product": { "name": "vers:unknown/v0.6.6", "product_id": "CSAFPID-3750948" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.7", "product": { "name": "vers:unknown/v0.6.7", "product_id": "CSAFPID-3750949" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.8", "product": { "name": "vers:unknown/v0.6.8", "product_id": "CSAFPID-3750950" } }, { "category": "product_version_range", "name": "vers:unknown/v0.6.9", "product": { "name": "vers:unknown/v0.6.9", "product_id": "CSAFPID-3750951" } }, { "category": "product_version_range", "name": "vers:unknown/v0.7.0", "product": { "name": "vers:unknown/v0.7.0", "product_id": "CSAFPID-3750952" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.0", "product": { "name": "vers:unknown/v0.8.0", "product_id": "CSAFPID-3750953" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.1", "product": { "name": "vers:unknown/v0.8.1", "product_id": "CSAFPID-3750954" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.2", "product": { "name": "vers:unknown/v0.8.2", "product_id": "CSAFPID-3750955" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.3", "product": { "name": "vers:unknown/v0.8.3", "product_id": "CSAFPID-3750956" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.4", "product": { "name": "vers:unknown/v0.8.4", "product_id": "CSAFPID-3750957" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.5", "product": { "name": "vers:unknown/v0.8.5", "product_id": "CSAFPID-3750958" } }, { "category": "product_version_range", "name": "vers:unknown/v0.8.6", "product": { "name": "vers:unknown/v0.8.6", "product_id": "CSAFPID-3750959" } }, { "category": "product_version_range", "name": "vers:unknown/v0.9.0", "product": { "name": "vers:unknown/v0.9.0", "product_id": "CSAFPID-3750960" } } ], "category": "product_name", "name": "melange" } ], "category": "vendor", "name": "chainguard-dev" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-29049", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "notes": [ { "category": "description", "text": "`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.\n\n**Fix:** Merged\n**Acknowledgements**\n\nmelange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.", "title": "github - https://github.com/advisories/GHSA-7rp8-r62p-q6wc" }, { "category": "description", "text": "`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.\n\n**Fix:** Merged\n**Acknowledgements**\n\nmelange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-7rp8-r62p-q6wc.json?alt=media" }, { "category": "description", "text": "melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-29049" }, { "category": "description", "text": "melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-29049" }, { "category": "description", "text": "`melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4588.json?alt=media" }, { "category": "description", "text": "melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-29049.json?alt=media" }, { "category": "description", "text": "`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.\n\n**Fix:** Merged\n**Acknowledgements**\n\nmelange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.", "title": "gitlab - https://gitlab.com/api/v4/projects/25847700/repository/files/go%2Fchainguard.dev%2Fmelange%2FCVE-2026-29049.yml/raw" }, { "category": "other", "text": "0.00039", "title": "EPSS" }, { "category": "other", "text": "4.6", "title": "NCSC Score" }, { "category": "other", "text": "Is related to CWE-400 (Uncontrolled Resource Consumption), There is product data available from source Nvd", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-5758947", "CSAFPID-5765484", "CSAFPID-5778685", "CSAFPID-3750849", "CSAFPID-3750850", "CSAFPID-3750851", "CSAFPID-3750852", "CSAFPID-3750853", "CSAFPID-3750854", "CSAFPID-3750855", "CSAFPID-3750856", "CSAFPID-3750857", "CSAFPID-3750858", "CSAFPID-3750859", "CSAFPID-3750860", "CSAFPID-3750861", "CSAFPID-3750862", "CSAFPID-3750863", "CSAFPID-3750864", "CSAFPID-3750865", "CSAFPID-3750866", "CSAFPID-3750867", "CSAFPID-3750868", "CSAFPID-3750869", "CSAFPID-3750870", "CSAFPID-3750871", "CSAFPID-3750872", "CSAFPID-3750873", "CSAFPID-3750874", "CSAFPID-3750875", "CSAFPID-3750876", "CSAFPID-3750877", "CSAFPID-3750878", "CSAFPID-3750879", "CSAFPID-3750880", "CSAFPID-3750881", "CSAFPID-3750882", "CSAFPID-3750883", "CSAFPID-3750884", "CSAFPID-3750885", "CSAFPID-3750886", "CSAFPID-3750887", "CSAFPID-3750888", "CSAFPID-3750889", "CSAFPID-3750890", "CSAFPID-3750891", "CSAFPID-3750892", "CSAFPID-3750893", "CSAFPID-3750894", "CSAFPID-3750895", "CSAFPID-3750896", "CSAFPID-3750897", "CSAFPID-3750898", "CSAFPID-3750899", "CSAFPID-3750900", "CSAFPID-3750901", "CSAFPID-3750902", "CSAFPID-3750903", "CSAFPID-3750904", "CSAFPID-3750905", "CSAFPID-3750906", "CSAFPID-3750907", "CSAFPID-3750908", "CSAFPID-3750909", "CSAFPID-3750910", "CSAFPID-3750911", "CSAFPID-3750912", "CSAFPID-3750913", "CSAFPID-3750914", "CSAFPID-3750915", "CSAFPID-3750916", "CSAFPID-3750917", "CSAFPID-3750918", "CSAFPID-3750919", "CSAFPID-3750920", "CSAFPID-3750921", "CSAFPID-3750922", "CSAFPID-3750923", "CSAFPID-3750924", "CSAFPID-3750925", "CSAFPID-3750926", "CSAFPID-3750927", "CSAFPID-3750928", "CSAFPID-3750929", "CSAFPID-3750930", "CSAFPID-3750931", "CSAFPID-3750932", "CSAFPID-3750933", "CSAFPID-3750934", "CSAFPID-3750935", "CSAFPID-3750936", "CSAFPID-3750937", "CSAFPID-3750938", "CSAFPID-3750939", "CSAFPID-3750940", "CSAFPID-3750941", "CSAFPID-3750942", "CSAFPID-3750943", "CSAFPID-3750944", "CSAFPID-3750945", "CSAFPID-3750946", "CSAFPID-3750947", "CSAFPID-3750948", "CSAFPID-3750949", "CSAFPID-3750950", "CSAFPID-3750951", "CSAFPID-3750952", "CSAFPID-3750953", "CSAFPID-3750954", "CSAFPID-3750955", "CSAFPID-3750956", "CSAFPID-3750957", "CSAFPID-3750958", "CSAFPID-3750959", "CSAFPID-3750960", "CSAFPID-5082332", "CSAFPID-5082333", "CSAFPID-5082334", "CSAFPID-5082335", "CSAFPID-5082336", "CSAFPID-5082337", "CSAFPID-5082338", "CSAFPID-5082339", "CSAFPID-5082340", "CSAFPID-5082341", "CSAFPID-5082342", "CSAFPID-5082343", "CSAFPID-5082344", "CSAFPID-5082345", "CSAFPID-5082346", "CSAFPID-5082347", "CSAFPID-5082348", "CSAFPID-5082349", "CSAFPID-5082350", "CSAFPID-5082351", "CSAFPID-5082352", "CSAFPID-5082353", "CSAFPID-5082354", "CSAFPID-5082355", "CSAFPID-5082356", "CSAFPID-5082357", "CSAFPID-5082358", "CSAFPID-5082359", "CSAFPID-5082360", "CSAFPID-5082361", "CSAFPID-5082362", "CSAFPID-5082363", "CSAFPID-5082364", "CSAFPID-5082365", "CSAFPID-5082366", "CSAFPID-5082367", "CSAFPID-5082368", "CSAFPID-5082369", "CSAFPID-5082370", "CSAFPID-5082371", "CSAFPID-5082372", "CSAFPID-5082373", "CSAFPID-5559121", "CSAFPID-5559122", "CSAFPID-5559123", "CSAFPID-5559124", "CSAFPID-5559125", "CSAFPID-5559126", "CSAFPID-5559127", "CSAFPID-5559128", "CSAFPID-5559129", "CSAFPID-5559130", "CSAFPID-5559131", "CSAFPID-5559132", "CSAFPID-5559133", "CSAFPID-5559134", "CSAFPID-5559135", "CSAFPID-5559136", "CSAFPID-5559137", "CSAFPID-5559138", "CSAFPID-5559139", "CSAFPID-5559140", "CSAFPID-5559141", "CSAFPID-5559142", "CSAFPID-5559143", "CSAFPID-5559144", "CSAFPID-5559145", "CSAFPID-5559146", "CSAFPID-5559147", "CSAFPID-5559148", "CSAFPID-5559149", "CSAFPID-5559150", "CSAFPID-5559151", "CSAFPID-5559152", "CSAFPID-5559153", "CSAFPID-5559154", "CSAFPID-5559155", "CSAFPID-5559156", "CSAFPID-5559157", "CSAFPID-5559158", "CSAFPID-5559159", "CSAFPID-5559160", "CSAFPID-5559161", "CSAFPID-5559162", "CSAFPID-5559163", "CSAFPID-5909026", "CSAFPID-5909027", "CSAFPID-5909028", "CSAFPID-5982411" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-7rp8-r62p-q6wc" }, { "category": "external", "summary": "Source raw - github", "url": "https://api.github.com/advisories/GHSA-7rp8-r62p-q6wc" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGHSA-7rp8-r62p-q6wc.json?alt=media" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29049" }, { "category": "external", "summary": "Source raw - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-29049" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-29049" }, { "category": "external", "summary": "Source raw - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/29xxx/CVE-2026-29049.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-29049" }, { "category": "external", "summary": "Source raw - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Go%2FGO-2026-4588.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-29049.json?alt=media" }, { "category": "external", "summary": "Source - gitlab", "url": "https://gitlab.com/api/v4/projects/25847700/repository/files/go%2Fchainguard.dev%2Fmelange%2FCVE-2026-29049.yml/raw" }, { "category": "external", "summary": "Reference - cveprojectv5; github; gitlab; nvd; osv", "url": "https://github.com/chainguard-dev/melange/security/advisories/GHSA-7rp8-r62p-q6wc" }, { "category": "external", "summary": "Reference - github; gitlab", "url": "https://github.com/advisories/GHSA-7rp8-r62p-q6wc" }, { "category": "external", "summary": "Reference - github; gitlab; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29049" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29049.json" }, { "category": "external", "summary": "Reference - gitlab", "url": "https://github.com/chainguard-dev/melange" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-3750849", "CSAFPID-3750850", "CSAFPID-3750851", "CSAFPID-3750852", "CSAFPID-3750853", "CSAFPID-3750854", "CSAFPID-3750855", "CSAFPID-3750856", "CSAFPID-3750857", "CSAFPID-3750858", "CSAFPID-3750859", "CSAFPID-3750860", "CSAFPID-3750861", "CSAFPID-3750862", "CSAFPID-3750863", "CSAFPID-3750864", "CSAFPID-3750865", "CSAFPID-3750866", "CSAFPID-3750867", "CSAFPID-3750868", "CSAFPID-3750869", "CSAFPID-3750870", "CSAFPID-3750871", "CSAFPID-3750872", "CSAFPID-3750873", "CSAFPID-3750874", "CSAFPID-3750875", "CSAFPID-3750876", "CSAFPID-3750877", "CSAFPID-3750878", "CSAFPID-3750879", "CSAFPID-3750880", "CSAFPID-3750881", "CSAFPID-3750882", "CSAFPID-3750883", "CSAFPID-3750884", "CSAFPID-3750885", "CSAFPID-3750886", "CSAFPID-3750887", "CSAFPID-3750888", "CSAFPID-3750889", "CSAFPID-3750890", "CSAFPID-3750891", "CSAFPID-3750892", "CSAFPID-3750893", "CSAFPID-3750894", "CSAFPID-3750895", "CSAFPID-3750896", "CSAFPID-3750897", "CSAFPID-3750898", "CSAFPID-3750899", "CSAFPID-3750900", "CSAFPID-3750901", "CSAFPID-3750902", "CSAFPID-3750903", "CSAFPID-3750904", "CSAFPID-3750905", "CSAFPID-3750906", "CSAFPID-3750907", "CSAFPID-3750908", "CSAFPID-3750909", "CSAFPID-3750910", "CSAFPID-3750911", "CSAFPID-3750912", "CSAFPID-3750913", "CSAFPID-3750914", "CSAFPID-3750915", "CSAFPID-3750916", "CSAFPID-3750917", "CSAFPID-3750918", "CSAFPID-3750919", "CSAFPID-3750920", "CSAFPID-3750921", "CSAFPID-3750922", "CSAFPID-3750923", "CSAFPID-3750924", "CSAFPID-3750925", "CSAFPID-3750926", "CSAFPID-3750927", "CSAFPID-3750928", "CSAFPID-3750929", "CSAFPID-3750930", "CSAFPID-3750931", "CSAFPID-3750932", "CSAFPID-3750933", "CSAFPID-3750934", "CSAFPID-3750935", "CSAFPID-3750936", "CSAFPID-3750937", "CSAFPID-3750938", "CSAFPID-3750939", "CSAFPID-3750940", "CSAFPID-3750941", "CSAFPID-3750942", "CSAFPID-3750943", "CSAFPID-3750944", "CSAFPID-3750945", "CSAFPID-3750946", "CSAFPID-3750947", "CSAFPID-3750948", "CSAFPID-3750949", "CSAFPID-3750950", "CSAFPID-3750951", "CSAFPID-3750952", "CSAFPID-3750953", "CSAFPID-3750954", "CSAFPID-3750955", "CSAFPID-3750956", "CSAFPID-3750957", "CSAFPID-3750958", "CSAFPID-3750959", "CSAFPID-3750960", "CSAFPID-5082332", "CSAFPID-5082333", "CSAFPID-5082334", "CSAFPID-5082335", "CSAFPID-5082336", "CSAFPID-5082337", "CSAFPID-5082338", "CSAFPID-5082339", "CSAFPID-5082340", "CSAFPID-5082341", "CSAFPID-5082342", "CSAFPID-5082343", "CSAFPID-5082344", "CSAFPID-5082345", "CSAFPID-5082346", "CSAFPID-5082347", "CSAFPID-5082348", "CSAFPID-5082349", "CSAFPID-5082350", "CSAFPID-5082351", "CSAFPID-5082352", "CSAFPID-5082353", "CSAFPID-5082354", "CSAFPID-5082355", "CSAFPID-5082356", "CSAFPID-5082357", "CSAFPID-5082358", "CSAFPID-5082359", "CSAFPID-5082360", "CSAFPID-5082361", "CSAFPID-5082362", "CSAFPID-5082363", "CSAFPID-5082364", "CSAFPID-5082365", "CSAFPID-5082366", "CSAFPID-5082367", "CSAFPID-5082368", "CSAFPID-5082369", "CSAFPID-5082370", "CSAFPID-5082371", "CSAFPID-5082372", "CSAFPID-5082373", "CSAFPID-5559121", "CSAFPID-5559122", "CSAFPID-5559123", "CSAFPID-5559124", "CSAFPID-5559125", "CSAFPID-5559126", "CSAFPID-5559127", "CSAFPID-5559128", "CSAFPID-5559129", "CSAFPID-5559130", "CSAFPID-5559131", "CSAFPID-5559132", "CSAFPID-5559133", "CSAFPID-5559134", "CSAFPID-5559135", "CSAFPID-5559136", "CSAFPID-5559137", "CSAFPID-5559138", "CSAFPID-5559139", "CSAFPID-5559140", "CSAFPID-5559141", "CSAFPID-5559142", "CSAFPID-5559143", "CSAFPID-5559144", "CSAFPID-5559145", "CSAFPID-5559146", "CSAFPID-5559147", "CSAFPID-5559148", "CSAFPID-5559149", "CSAFPID-5559150", "CSAFPID-5559151", "CSAFPID-5559152", "CSAFPID-5559153", "CSAFPID-5559154", "CSAFPID-5559155", "CSAFPID-5559156", "CSAFPID-5559157", "CSAFPID-5559158", "CSAFPID-5559159", "CSAFPID-5559160", "CSAFPID-5559161", "CSAFPID-5559162", "CSAFPID-5559163", "CSAFPID-5758947", "CSAFPID-5765484", "CSAFPID-5778685", "CSAFPID-5909026", "CSAFPID-5909027", "CSAFPID-5909028", "CSAFPID-5982411" ] } ], "title": "CVE-2026-29049" } ] }