Read the docs
TI-2026-20302 Aliases CVE-2026-25140

apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix Fixed apko (chainguard-dev): 1.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
chainguard-devapko0.14.8 to before 1.1.11.1.1Patch availableCNA
  • apko Vendorchainguard-dev Affected 0.14.8 to before 1.1.1 Fixed in 1.1.1 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:*0.14.8 to before 1.1.1Vulnerablechainguard-dev
  • cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:* Versions 0.14.8 to before 1.1.1 Vulnerable ·chainguard-dev

Remediation

  • Fix · CNA apko (chainguard-dev) Fixed in 1.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-25140

References

Patch 1

Advisory 1

  • TI-2026-20284 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base CVSS 3.1HIGH 7.5
  • TI-2026-20285 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences