CVE-2026-25140: apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or…

PriorityP342high7.5CVSS 3.1

AVNACLPRNUINSUCNINAH

EPSS

0.37%

29.0th percentile

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
chainguard-dev	apko	—	—
chainguard.dev	apko	>= 0.14.8 < 1.1.1	1.1.1
chainguard	apko	>= 0.14.8 < 1.1.1	1.1.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.