CVE-2026-54174

Summary

melange: Incomplete package integrity verification allows data section substitution

Severity

high

CVSS

8.3

CWE

CWE-345, CWE-354

Also known as

GHSA-fpg8-7664-jc5q#chainguard.dev/apko

Published

2026-07-10

Updated

2026-07-10

Advisory details

Previously, Apko verified the control section hash (.PKGINFO etc.) against the signed APKINDEX, but never verified the data section hash (the actual package files that get installed). An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

References

• https://github.com/advisories/GHSA-fpg8-7664-jc5q
• https://github.com/chainguard-dev/melange/security/advisories/GHSA-fpg8-7664-jc5q

Related advisories

• CVE-2026-42575 — high · Go/chainguard.dev/apko
• CVE-2026-42574 — high · Go/chainguard.dev/apko
• CVE-2026-42576 — medium · Go/chainguard.dev/apko
• CVE-2026-25140 — medium · Go/chainguard.dev/apko
• CVE-2026-25122 — medium · Go/chainguard.dev/apko
• CVE-2026-25121 — medium · Go/chainguard.dev/apko
• CVE-2026-53513 — critical · npm/@better-auth/sso
• CVE-2026-53512 — critical · npm/better-auth

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity