Approved changes feed: RSS · Atom

cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:*

part: a version: * update: *

VendorChainguard (ec00b875-0f2e-5e9f-ab7c-43145877d109)
ProductApko (36725d30-0982-586e-9bcd-9abc992eb84d)
Edition*
Language*
Software edition*
Target softwarego
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/chainguard-dev/apko purl2cpe 2026-06-01 10:16:12.948923
pkg:golang/github.com/chainguard-dev/apko purl2cpe 2026-06-01 10:16:12.948925

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-25140 vulnerable 2026-06-08 07:53:19.042252 apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
HIGH (7.5)
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.
Published: 2026-02-04T19:02:20.988Z
Updated: 2026-02-04T19:17:36.596Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-25122 vulnerable 2026-06-08 07:53:19.019691 apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
MEDIUM (5.5)
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.
Published: 2026-02-04T19:02:15.838Z
Updated: 2026-02-04T19:19:35.546Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-25121 vulnerable 2026-06-08 07:53:19.019160 apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
HIGH (7.5)
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
Published: 2026-02-04T19:02:17.979Z
Updated: 2026-02-04T19:18:52.495Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.