Resource Exhaustion Vulnerability in apko by Chainguard

CVE-2026-25140

What is CVE-2026-25140?

The apko tool, utilized for building and publishing OCI container images from APK packages, has a vulnerability impacting versions from 0.14.8 to just before 1.1.1. An attacker controlling a compromised APK repository can manipulate the ExpandApk function, which expands APK streams without adequate decompression limits. This oversight enables the deployment of a compact, highly-compressed APK that decompresses into an extensive tar stream, resulting in excessive consumption of disk space and CPU resources. Such exploitation can lead to significant build failures or even a complete denial of service for the build host. This security issue has been addressed in version 1.1.1.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References