Skip to content
Heist/ feed
Back to feed
Medium

apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

Type: advisorySources: OSV

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-25122
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 18:28 UTC · Revision 1

Source evidence

apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

core-osv · Original source

Published 4 Feb 2026, 19:02 UTC

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.

osv:CVE-2026-25122
Complete source record
{
  "id": "affd6b20d459b6bf732369f7afd220e69ec1ee29cbb107e3fc4e7cd7f3c02b3d",
  "url": "https://osv.dev/vulnerability/CVE-2026-25122",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams",
    "summary": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.",
    "evidence": "osv:CVE-2026-25122",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-25122",
      "aliases": [
        "CVE-2026-25122",
        "GHSA-6p9p-q6wh-9j89",
        "GO-2026-4406"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/chainguard-dev/apko",
              "type": "GIT",
              "events": [
                {
                  "introduced": "95e33993764a6a6f7cc4098453260cc6da7e71a1"
                },
                {
                  "fixed": "2be3903fe194ad46351840f0569b35f5ac965f09"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0.14.8"
                      },
                      {
                        "fixed": "1.1.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StringRangeExpression"
                  },
                  {
                    "range": [
                      {
                        "fixed": "2be3903fe194ad46351840f0569b35f5ac965f09"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  },
                  {
                    "cpe": "cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:*",
                    "range": [
                      {
                        "introduced": "0.14.8"
                      },
                      {
                        "fixed": "1.1.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.0.5",
            "v1.0.4",
            "v1.0.3",
            "v1.0.2",
            "v1.0.1",
            "v1.0.0",
            "v0.30.35",
            "v0.30.34",
            "v0.30.33",
            "v0.30.32",
            "v0.30.31",
            "v0.30.30",
            "v0.30.29",
            "v0.30.28",
            "v0.30.27",
            "v0.30.26",
            "v0.30.25",
            "v0.30.24",
            "v0.30.23",
            "v0.30.22",
            "v0.30.21",
            "v0.30.20",
            "v0.30.19",
            "v0.30.18",
            "v0.30.17",
            "v0.30.16",
            "v0.30.15",
            "v0.30.14",
            "v0.30.13",
            "v0.30.12",
            "v0.30.11",
            "v0.30.10",
            "v0.30.9",
            "v0.30.8",
            "v0.30.7",
            "v0.30.6",
            "v0.30.5",
            "v0.30.4",
            "v0.30.3",
            "v0.30.2",
            "v0.30.1",
            "v0.30.0",
            "v0.29.10",
            "v0.29.9",
            "v0.29.8",
            "v0.29.7",
            "v0.29.6",
            "v0.29.5",
            "v0.29.4",
            "v0.29.3",
            "v0.29.2",
            "v0.29.1",
            "v0.29.0",
            "v0.28.0",
            "v0.27.9",
            "0.27.8",
            "v0.27.7",
            "v0.27.6",
            "v0.27.5",
            "v0.27.4",
            "v0.27.3",
            "v0.27.2",
            "v0.27.1",
            "v0.27.0",
            "v0.26.1",
            "v0.26.0",
            "v0.25.7",
            "v0.25.6",
            "v0.25.5",
            "v0.25.4",
            "v0.25.3",
            "v0.25.2",
            "v0.25.1",
            "v0.25.0",
            "v0.24.0",
            "v0.23.0",
            "v0.22.7",
            "v0.22.6",
            "v0.22.5",
            "v0.22.4",
            "v0.22.3",
            "v0.22.2",
            "v0.22.1",
            "v0.21.0",
            "v0.20.2",
            "v0.20.1",
            "v0.20.0",
            "v0.19.9",
            "v0.19.8",
            "v0.19.7",
            "v0.19.6",
            "v0.19.5",
            "v0.19.4",
            "v0.19.3",
            "v0.19.2",
            "v0.19.1",
            "v0.19.0",
            "v0.18.1",
            "v0.18.0",
            "v0.17.0",
            "v0.16.0",
            "v0.15.0",
            "v0.14.9",
            "v0.14.8"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25122.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.317292173Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25122.json",
        "https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-25122",
        "https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-400"
        ],
        "cna_assigner": "GitHub_M",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25122.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-25122",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505696,
  "published_at": "2026-02-04T19:02:15.838+00:00"
}