Melange, a tool for building APK packages through declarative pipelines, contains an unbounded HTTP download flaw in its update-cache command. The code copies remote content without imposing a download size limit or HTTP client timeout, enabling an attacker who controls a URI referenced in a melange configuration to write unlimited data to disk. The resulting disk exhaustion can cause the CI build runner to run out of space and fail, effectively degrading availability.

The affected product is Chainguard's melange, versions 0.40.5 and earlier. This flaw was identified in the pkg/renovate/cache/cache.go file. The vulnerability applies to any environment where melange update-cache is executed with a build configuration that includes attacker-supplied download URLs.

The CVSS score is 4.3, and EPSS is undersampled (< 1 %), indicating a moderate severity with a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, suggesting it is not currently an actively exploited vulnerability. Exploitation requires control over the melange configuration used in a CI pipeline; therefore the attack vector is likely remote delivery through compromised or malicious build definitions.