Approved changes feed: RSS · Atom
cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:*
part: a version: * update: *
| Vendor | Chainguard (ec00b875-0f2e-5e9f-ab7c-43145877d109) |
|---|---|
| Product | Apko (36725d30-0982-586e-9bcd-9abc992eb84d) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | go |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/chainguard-dev/apko |
purl2cpe | 2026-06-01 10:16:12.948923 |
pkg:golang/github.com/chainguard-dev/apko |
purl2cpe | 2026-06-01 10:16:12.948925 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-25140 |
vulnerable | 2026-06-08 07:53:19.042252 |
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
HIGH (7.5)
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.
Published: 2026-02-04T19:02:20.988Z
Updated: 2026-02-04T19:17:36.596Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25122 |
vulnerable | 2026-06-08 07:53:19.019691 |
apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
MEDIUM (5.5)
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.
Published: 2026-02-04T19:02:15.838Z
Updated: 2026-02-04T19:19:35.546Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25121 |
vulnerable | 2026-06-08 07:53:19.019160 |
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
HIGH (7.5)
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory. This issue has been patched in version 1.1.1.
Published: 2026-02-04T19:02:17.979Z
Updated: 2026-02-04T19:18:52.495Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.