CVE-2026-25140

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25140", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.820Z", "datePublished": "2026-02-04T19:02:20.988Z", "dateUpdated": "2026-02-04T19:17:36.596Z"}, "containers": {"cna": {"title": "apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6"}, {"name": "https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09", "tags": ["x_refsource_MISC"], "url": "https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09"}], "affected": [{"vendor": "chainguard-dev", "product": "apko", "versions": [{"version": ">= 0.14.8, < 1.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:02:20.988Z"}, "descriptions": [{"lang": "en", "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1."}], "source": {"advisory": "GHSA-f4w5-5xv9-85f6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T19:17:26.936567Z", "id": "CVE-2026-25140", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T19:17:36.596Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25140", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T19:17:26.936567Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T19:17:31.427Z"}}], "cna": {"title": "apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams", "source": {"advisory": "GHSA-f4w5-5xv9-85f6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "chainguard-dev", "product": "apko", "versions": [{"status": "affected", "version": ">= 0.14.8, < 1.1.1"}]}], "references": [{"url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6", "name": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09", "name": "https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-04T19:02:20.988Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25140", "state": "PUBLISHED", "dateUpdated": "2026-02-04T19:17:36.596Z", "dateReserved": "2026-01-29T15:39:11.820Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-04T19:02:20.988Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "apko", "vendor": "chainguard-dev", "versions": [{"status": "affected", "version": ">= 0.14.8, < 1.1.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:*", "matchCriteriaId": "D4999F65-41B1-42B5-8BFE-C5DD249E18F3", "versionEndExcluding": "1.1.1", "versionStartIncluding": "0.14.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1."}, {"lang": "es", "value": "apko permite a los usuarios construir y publicar im\u00e1genes de contenedor OCI construidas a partir de paquetes apk. Desde la versi\u00f3n 0.14.8 hasta antes de la 1.1.1, un atacante que controle o comprometa un repositorio APK utilizado por apko podr\u00eda causar el agotamiento de recursos en el host de compilaci\u00f3n. La funci\u00f3n ExpandApk en pkg/apk/expandapk/expandapk.go expande flujos .apk sin aplicar l\u00edmites de descompresi\u00f3n, permitiendo que un repositorio malicioso sirva un .apk peque\u00f1o y altamente comprimido que se infla en un gran flujo tar, consumiendo espacio en disco y tiempo de CPU excesivos, causando fallos de compilaci\u00f3n o denegaci\u00f3n de servicio. Este problema ha sido parcheado en la versi\u00f3n 1.1.1."}], "id": "CVE-2026-25140", "lastModified": "2026-06-17T10:24:10.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25140", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T19:17:26.936567Z", "version": "2.0.3"}}]}, "published": "2026-02-04T19:16:15.117", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T23:20:25.590296+00:00", "value": {"mitigation_remediation": ["Upgrade Apko to version 1.1.1 or later, which includes the fix that enforces decompression limits.", "Verify the authenticity and integrity of APK repositories and packages by validating cryptographic signatures or checksums before use, to reduce the risk of a malicious repository being used.", "If possible, implement resource limits on the build environment, such as cgroup or container runtime restrictions, to mitigate the impact of unexpected resource consumption."], "summary": {"action": "Apply Patch", "impact": "Unbounded Resource Consumption (Denial of Service)"}, "threat_synthesis": {"affected_systems": "Chainguard's Apko, from version 0.14.8 up to but not including 1.1.1, is affected. Systems using the vulnerable version of Apko and fetching packages from an attacker\u2011controlled or compromised APK repository are at risk.", "description_and_impact": "ExpandApk in Apko expands .apk streams without a decompression limit, allowing a malicious repository that serves a small, highly\u2011compressed .apk to inflate into a large tar stream. This can consume excessive disk space and CPU time during image build, potentially causing build failures or a denial of service.", "risk_and_exploitability": "With a CVSS score of 7.5 the vulnerability carries a moderate severity. The EPSS score is below 1\u202f% indicating a low likelihood of exploitation in the wild, and the issue is not currently listed in the CISA KEV catalog. The attack requires an attacker to control or compromise the APK repository used by Apko; they can then serve the compressed .apk to trigger resource exhaustion on the build host."}}}}, "created": "2026-02-05T11:39:19.861389+00:00", "updated": "2026-04-17T23:30:15.909981+00:00", "vendors": ["chainguard-dev", "chainguard-dev$PRODUCT$apko"]}