CVE-2026-25140
📋 TL;DR
This vulnerability in apko allows attackers who control or compromise APK repositories to cause resource exhaustion on build hosts. By serving a small, highly-compressed .apk file that expands into a large tar stream, attackers can consume excessive disk space and CPU time, leading to build failures or denial of service. Users of apko versions 0.14.8 through 1.1.0 are affected when building container images from untrusted APK repositories.
💻 Affected Systems
- apko
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service on build infrastructure, causing production build pipelines to fail and potentially disrupting container image delivery.
Likely Case
Intermittent build failures and performance degradation on CI/CD systems using vulnerable apko versions with untrusted APK repositories.
If Mitigated
Minimal impact if using only trusted APK repositories and monitoring resource usage.
🎯 Exploit Status
Exploitation requires control or compromise of an APK repository used by the vulnerable apko instance.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.1
Vendor Advisory: https://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6
Restart Required: No
Instructions:
1. Update apko to version 1.1.1 or later using your package manager. 2. Verify the update with 'apko version'. 3. Rebuild any container images created with vulnerable versions.
🔧 Temporary Workarounds
Use only trusted APK repositories
allConfigure apko to use only known, trusted APK repositories and avoid untrusted sources.
Modify apko configuration files to specify trusted repository URLs only
Implement resource limits
linuxRun apko builds with resource constraints to limit potential impact.
docker run --memory=2g --cpus=2 ...
Use container runtime resource limits
🧯 If You Can't Patch
- Use only verified, trusted APK repositories for all builds
- Monitor build system resource usage and implement alerts for abnormal consumption
🔍 How to Verify
Check if Vulnerable:
Check apko version with 'apko version' command and verify if it's between 0.14.8 and 1.1.0Check Version:
apko versionVerify Fix Applied:
Confirm apko version is 1.1.1 or later with 'apko version'📡 Detection & Monitoring
Log Indicators:
- Unusually large tar expansion operations
- Build failures due to disk space exhaustion
- High CPU usage during .apk decompression
Network Indicators:
- Connections to untrusted APK repositories
- Large downloads from APK repositories
SIEM Query:
source="apko" AND ("disk full" OR "out of memory" OR "decompression failed")