https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T12:10:39.585951+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-54174 CVE-2026-54174 — melange: Incomplete package integrity verification allows data section substitution 2026-09-29T12:10:39.642037+00:00

Affected: chainguard-dev melange, chainguard-dev apko

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash (`.PKGINFO` etc.) against the signed `APKINDEX`, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed. Apko version 1.2.9 and melange version 0.50.4 contain a fix.