Executive brief
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko
Affected products
- Go chainguard.dev/apko
Junglewise Threat Intelligence
CVE-2026-25140: GO-2026-4410 - apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko
CVE-2026-25140 · Severity: info · Published 2026-02-26
Technologies: chainguard.dev/apko (Go). Vendors: Go.
Related threats
- melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to versi
- Chainguard apko denial of service via incorrect type assertion in DiscoverKeys
- Chainguard apko insufficient integrity check for apk packages
- Chainguard apko path traversal via symlink following in DirFS
- GO-2026-4405 - apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko