chainguard-dev apko up to 1.0.x Split resource consumption

Summaryinfo

A vulnerability marked as problematic has been reported in chainguard-dev apko up to 1.0.x. This impacts the function Split. Performing a manipulation results in resource consumption. This vulnerability is reported as CVE-2026-25122. The attack requires a local approach. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in chainguard-dev apko up to 1.0.x. This affects the function Split. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. The summary by CVE is:

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-25122 since 01/29/2026. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available.

Upgrading to version 1.1.0 eliminates this vulnerability. Applying the patch 2be3903fe194ad46351840f0569b35f5ac965f09 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• chainguard-dev

Name

• apko

Version

• 1.0

License

• open-source

Website

• Product: https://github.com/chainguard-dev/apko/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion