CVE-2026-25140
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
Impact
An attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. **Fix**: Fixed in [2be3903](https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09). Released in 1.1.0. **Acknowledgements** apko thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | chainguard-dev/apko | > 0.14.8, < 1.1.0 | 1.1.0 |
| go | chainguard.dev/apko | >= 0.14.8, < 1.1.1 | 1.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Chainguard | Apko | from 0.14.8 before 1.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6
- https://github.com/advisories/GHSA-f4w5-5xv9-85f6
- https://nvd.nist.gov/vuln/detail/CVE-2026-25140
- https://pkg.go.dev/vuln/GO-2026-4410