melange

melange Build apk packages using declarative pipelines. Commonly used to provide custom packages for container images built with apko. The majority of apks are built for use with either the Wolfi or Alpine Linux ecosystems. Key features: Pipeline-oriented builds. Every step of the build pipeline ...

CVE-2026-54174 melange: Incomplete package integrity verification allows data section substitution

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...

GHSA-4C74-G9CQ-VHC5 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-556C-3R39-WVFX vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-6C49-XC7V-MQVW vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-8264-G9FH-VX2H vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-87CJ-725F-6HR5 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-8VM6-JVF8-6W38 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-CG5C-7728-29V7 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-F2M7-5M7M-7G2C vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-F3MP-M5HM-H688 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-P5XX-69G5-8564 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-XQ85-JG4P-XF7W vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

GHSA-HRH3-6X34-5FXF vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-53113 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-64082 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-64154 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-64388 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...

CVE-2026-53091 vulnerabilities

Vulnerabilities for packages: linux-qemu-melange...