CVE-2026-25140

The record

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.

Affected packages

Related vulnerabilities

• CVE-2026-25121 apko allows users to build and publish OCI container images built from apk packages. Also affects chainguard.dev/apko
• CVE-2026-25122 apko allows users to build and publish OCI container images built from apk packages. Also affects chainguard.dev/apko
• CVE-2025-15558 Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins… Also affects dagdotdev
• CVE-2026-26958 filippo.io/edwards25519 is a Go library implementing the edwards25519 elliptic curve with… Also affects dagdotdev
• CVE-2025-47906 If the PATH environment variable contains paths which are executables (rather than just… Also affects dagdotdev
• CVE-2024-41110 Moby is an open-source project created by Docker for software containerization. Also affects dagdotdev
• CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
• CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb