Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-25140: apko may consume all disk space during image build
CVE-2026-25140 · published 9 months ago
Summary
Versions of apko from 0.14.8 up to 1.1.0 can be tricked by a malicious package repository into unpacking a tiny, highly compressed file that expands to a huge amount of data. This can fill the build computer’s storage and CPU, causing the build to fail or the host to become unresponsive. Upgrade apko to version 1.1.1 or later, and only use trusted repositories.
What to do
- Update chainguard-dev apko to version 1.1.0.
- Update chainguard.dev apko to version 1.1.1.
- Update chainguard apko to version 1.1.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | chainguard-dev | apko |
> 0.14.8, < 1.1.0 Fix: upgrade to 1.1.0
|
| go | chainguard.dev | apko |
>= 0.14.8, < 1.1.1 Fix: upgrade to 1.1.1
|
| – | chainguard | apko |
>= 0.14.8, < 1.1.1 cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:* |
Original advisory text
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.
References
- https://pkg.go.dev/vuln/GO-2026-4410
- https://github.com/advisories/GHSA-f4w5-5xv9-85f6
- https://nvd.nist.gov/vuln/detail/CVE-2026-25140 Vendor Advisory
- https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6 Vendor Advisory
- https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25140... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published4 Feb 2026
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta