CVE-2026-54174

4 advisories.

Go/chainguard.dev/apko CVE-2026-54174: high 8.3

melange: Incomplete package integrity verification allows data section substitution

Action: Upgrade chainguard.dev/apko to 1.2.9 or later.

go get chainguard.dev/apko@v1.2.9

Affected

introduced	fixed	last affected
0	1.2.9	-

Fixed versions

1.2.9

Sources

CVE-2026-54174 · published 2026-07-10T21:43:05Z · modified 2026-09-10T03:50:51.801246105Z · JSON

Go/chainguard.dev/melange CVE-2026-54174: high 8.3

melange: Incomplete package integrity verification allows data section substitution

Action: Upgrade chainguard.dev/melange to 0.50.4 or later.

go get chainguard.dev/melange@v0.50.4

Affected

introduced	fixed	last affected
0	0.50.4	-

Fixed versions

0.50.4

Sources

CVE-2026-54174 · published 2026-07-10T21:43:05Z · modified 2026-09-10T03:50:51.801246105Z · JSON

Go/chainguard.dev/apko CVE-2026-54174: unknown

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Action: Upgrade chainguard.dev/apko to 1.2.9 or later.

go get chainguard.dev/apko@v1.2.9

Affected

introduced	fixed	last affected
0	1.2.9	-

Fixed versions

1.2.9

Sources

CVE-2026-54174 · published 2026-07-17T19:42:05Z · modified 2026-07-22T20:59:39.183404011Z · JSON

Go/chainguard.dev/melange CVE-2026-54174: unknown

melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko

Action: Upgrade chainguard.dev/melange to 0.50.4 or later.

go get chainguard.dev/melange@v0.50.4

Affected

introduced	fixed	last affected
0	0.50.4	-

Fixed versions

0.50.4

Sources

CVE-2026-54174 · published 2026-07-17T19:42:05Z · modified 2026-07-22T20:59:39.183404011Z · JSON