melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout (pkg/renovate/cache/cache.go). An attacker-controlled URI in a melange config can cause unbounded disk writes, exhausting disk on the build runner. Version 0.43.4 contains a patch.

Chainguard’s melange, version 0.40.5 and earlier, are affected. The flaw resides in the pkg module. Any environment that runs melange update-cache with a build configuration containing attacker‑supplied download URLs is exposed.

The CVSS score is 4.3 and the EPSS score is <1%. The vulnerability is not listed in the CISA KEV catalog and no exploitation reports are documented in the CVE data. The likely attack vector is remote delivery via a compromised or malicious build definition. An build failures and resource denial for other jobs.