CVE-2026-25140 json
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
published 2026-02-04 9 mo ago modified 2026-06-17 4 mo ago also GHSA-f4w5-5xv9-85f6 , GO-2026-4410 , EUVD-2026-5381
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 35%
- public exploits
- 0
- none known
Summary
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.
Patch / fix
- go chainguard.dev/apko 1.1.1
- chainguard apko 1.1.1
- govulncheck-vulndb openSUSE Leap 15.6 0.0.20260226T182644-150000.1.149.1
suse advisories SUSE-SU-2026:0757-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 9 mo ago
Exploit prediction
0.41% chance of exploitation in the next 30 days, higher than 35% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | chainguard.dev/apko | >=0.14.8, <1.1.1 |
1.1.1 |
Affected products
- chainguard-dev apko
Classification
References
-
github.com
/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09
patch
-
github.com
/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-25140
advisory
Sources
- CVE List CVE-2026-25140
- NVD CVE-2026-25140
- OSV GO-2026-4410
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.