chainguard-dev/apko · Security
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
- GHSA ID
- GHSA-f4w5-5xv9-85f6
- CVE ID
- CVE-2026-25140
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
An attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service.
Fix: Fixed in 2be3903. Released in 1.1.0.
Acknowledgements
apko thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
CWEs
- CWE-400 · Uncontrolled Resource Consumption
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6 ↗
- https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-25140 ↗
- https://pkg.go.dev/vuln/GO-2026-4410 ↗
- https://github.com/advisories/GHSA-f4w5-5xv9-85f6 ↗