What is GHSA-f4w5-5xv9-85f6?

GHSA-f4w5-5xv9-85f6 is a security advisory published by GitHub Security Advisories with High severity. apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

Which CVE IDs does GHSA-f4w5-5xv9-85f6 cover?

GHSA-f4w5-5xv9-85f6 covers the following CVE IDs: CVE-2026-25140. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f4w5-5xv9-85f6?

GHSA-f4w5-5xv9-85f6 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-f4w5-5xv9-85f6?

GHSA-f4w5-5xv9-85f6 affects 2 products, including: go/chainguard-dev/apko:\u003e 0.14.8, \u003c 1.1.0; go/chainguard.dev/apko:\u003e= 0.14.8, \u003c 1.1.1.

GHSA-f4w5-5xv9-85f6HighCVSS 7.5

apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

Vendor

GitHub Security Advisories

Published

February 4, 2026

Last Modified

February 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-25140 →

📋 Description

An attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service.

Fix: Fixed in 2be3903. Released in 1.1.0.

Acknowledgements

apko thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.

🎯 Affected products2

go/chainguard-dev/apko:> 0.14.8, < 1.1.0
go/chainguard.dev/apko:>= 0.14.8, < 1.1.1

🔗 CVE IDs covered (1)

📋 Description

🎯 Affected products2

🔗 References (5)