{"cve":"CVE-2026-25140","nvd":{"published":"2026-02-04T19:16:15.117","modified":"2026-06-17T10:24:10.650","status":"Analyzed","description":"apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-770","CWE-400"],"references":["https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09","https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6"],"products":["chainguard:apko"],"source":"nvd","synced_at":"2026-10-19T22:22:27.261130201+00:00"},"epss":{"cve":"CVE-2026-25140","score":0.00407,"percentile":0.34945,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GO-2026-4410","url":"https://osv.dev/vulnerability/GO-2026-4410","summary":"apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko","modified":"2026-03-18T17:12:28.050165Z","packages":[{"ecosystem":"Go","name":"chainguard.dev/apko","purl":"pkg:golang/chainguard.dev/apko","ranges":[">=0.14.8 <1.1.1"],"fixed":["1.1.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}