CVE-2026-25122

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact). The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown. This issue has been patched in version 1.1.0.

• CWE-400
• CWE-770

• https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09Patch
• https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89Third Party Advisory

Published

Feb 4, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25117pwn.college DOJO is an education platform for learning cyber…8.3
• CVE-2026-25118immich is a high performance self-hosted photo and video man…7.5
• CVE-2026-25119Gogs is an open source self-hosted Git service. Prior to 0.1…7.7
• CVE-2026-2512The Code Embed plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-25120Gogs is an open source self-hosted Git service. In versions …2.7
• CVE-2026-25121apko allows users to build and publish OCI container images …7.5
• CVE-2026-25123Homarr is an open-source dashboard. Prior to 1.52.0, a publi…5.3
• CVE-2026-25124OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25125October is a Content Management System (CMS) and web platfor…4.9
• CVE-2026-25126PolarLearn is a free and open-source learning program. Prior…7.1
• CVE-2026-25127OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25128fast-xml-parser allows users to validate XML, parse XML to J…7.5