Melange Unbounded Disk Write Vulnerability in Update-Cache Function

A vulnerability exists in Melange versions through 0.40.5, allowing unbounded disk writes via the 'update-cache' function. This occurs because the function downloads URIs from build configurations without any size limit or HTTP client timeout. An attacker can exploit this by inserting a controlled URI into the Melange config, leading to excessive disk usage on the build runner.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by exhausting disk space on the build runner.