VDB
GO-2026-4588
GO-2026-4588
PUBLISHED
`melange update-cache` has unbounded HTTP download that can exhaust disk in CI in chainguard.dev/melange
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | melange | * |
| chainguard | dl | 0 |
| chainguard | wolfictl | 0 |
| wolfi | wolfictl | 0 |
| chainguard | cg | 0 |
| wolfi | melange | * |
| chainguard.dev | melange | 0 |
| chainguard | apply-cve-bump | 0 |
Timeline
- Mar 10, 2026 CVE Published
- Jun 26, 2026 CVE Updated