https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T09:19:22.470389+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333606 EUVD-2026-333606 2026-10-06T09:19:22.516936+00:00 EUVD-2026-333606 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29049 fkie_cve-2026-29049 2026-10-06T09:19:22.516975+00:00

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runne. Version 0.43.4 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-7rp8-r62p-q6wc GHSA-7rp8-r62p-q6wc — `melange update-cache` has unbounded HTTP download that can exhaust disk in CI 2026-10-06T09:19:22.517010+00:00

Affected: Go: chainguard.dev/melange

`melange update-cache` downloads URIs from build configs via `io.Copy` without any size limit or HTTP client timeout (`pkg/renovate/cache/cache.go`). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.

**Fix:** Merged **Acknowledgements**

Thank you to Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.