PT-2026-6268 · Apko · Apko

1Seal · Published 2026-02-03 · Updated 2026-02-20 · CVE-2026-25122

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions apko versions 0.14.8 through 1.0.9

Description apko is a tool for building and publishing OCI container images from apk packages. A flaw exists in the expandapk.Split function where it drains the first gzip stream of an APK archive without explicit bounds. An attacker-controlled input stream can cause excessive gzip inflation, leading to resource exhaustion and potentially impacting availability. The Split function reads the first tar header and then drains the remaining gzip stream without limits on uncompressed byte size or inflation ratio. Parsing attacker-controlled APK streams may result in high CPU usage during gzip inflation, potentially causing timeouts or process slowdowns.

Recommendations Update to version 1.1.0 or later.

Exploit

Fix

Allocation of Resources Without Limits

Resource Exhaustion

Weakness Enumeration

CWE-770

CWE-400

Related Identifiers

CVE-2026-25122

GHSA-6P9P-Q6WH-9J89

GO-2026-4406

SUSE-SU-2026:0403-1

Affected Products

Apko

References · 88

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25122.json · Exploit
• https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09 · Patch
• https://osv.dev/vulnerability/CVE-2026-25122 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6p9p-q6wh-9j89 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4406 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25122 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://github.com/chainguard-dev/apko · Note
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89 · Note
• https://suse.com/security/cve/CVE-2026-24514 · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2026-25145 · Note
• https://suse.com/security/cve/CVE-2026-23992 · Note
• https://suse.com/security/cve/CVE-2026-20897 · Note
• https://suse.com/security/cve/CVE-2026-23518 · Note