chainguard-dev vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20252
3. 202618

Newest CVEs

• CVE-2026-105768

  apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root

  chainguard-dev · apko

  Medium6.3
• CVE-2026-54174

  melange: Incomplete package integrity verification allows data section substitution

  chainguard-dev · melange

  High8.3
• CVE-2026-42576

  apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

  chainguard-dev · apko

  Medium6.5
• CVE-2026-42575

  apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

  chainguard-dev · apko

  High7.5
• CVE-2026-42574

  apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

  chainguard-dev · apko

  High7.5
• CVE-2026-29051

  melange has Path Traversal via .PKGINFO in --persist-lint-results

  chainguard-dev · melange

  Medium4.4
• CVE-2026-29050

  melange has Path Traversal When Resolving External Pipelines via Unvalidated pipeline[].uses

  chainguard-dev · melange

  Medium6.1
• CVE-2026-29049

  melange: unbounded HTTP download in `melange update-cache` can exhaust disk in CI

  chainguard-dev · melange

  Medium4.3
• CVE-2026-28407

  malcontent's nested archive extraction failure can drop content from scan inputs

  chainguard-dev · malcontent

  Medium6.9
• CVE-2026-25145

  melange has a path traversal in license-path which allows reading files outside workspace

  chainguard-dev · melange

  Medium5.5