| Package | Affected versions | Patched versions |
|---|---|---|
| chainguard.dev/melange | < 0.43.4all versions | 0.43.4 |
| melange | ≤ 0.40.5 |
melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Affected versions <= 0.40.5.
Fix: Merged Acknowledgements
Thank you to Oleh Konko from 1seal for discovering and reporting this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free