Resource Exhaustion Vulnerability in Apko by Chainguard
CVE-2026-25122

5.5MEDIUM

Key Information:

Vendor

Chainguard-dev

Status
Apko
Vendor
CVE Published:
4 February 2026

What is CVE-2026-25122?

The Apko tool by Chainguard, designed for building and publishing OCI container images from APK packages, has a vulnerability in its expandapk.Split function. This issue allows an attacker to leverage controlled input streams, which can unintentionally force excessive CPU usage during the decompression of gzipped data. The function does not enforce maximum uncompressed byte limits, potentially resulting in resource exhaustion and subsequent service disruptions. It is essential to upgrade to version 1.1.0 or later to mitigate this vulnerability.

Affected Version(s)

apko >= 0.14.8, < 1.1.0

References

https://github.com/chainguard-dev/apko/security/advisorie...
x_refsource_CONFIRM
https://github.com/chainguard-dev/apko/commit/2be3903fe19...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.