Is CVE-2026-29049 actively exploited?

No active exploitation of CVE-2026-29049 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-29049 be exploited remotely?

Yes. CVE-2026-29049 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-29049?

CVE-2026-29049 has a CVSS score of 4.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-29049

MEDIUM

CVE-2026-29049

CWE-400Published: March 6, 2026· Updated: Mar 10, 2026

4.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.6th

Official Description

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. There is no known patch publicly available.

NVD Source

Technical Analysis

CVE-2026-29049 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.