CVE-2026-25140: chainguard-dev apko Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-25140 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in chainguard-dev apko. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 3Timeline
- 04-02-2026PublishedVulnerability first disclosed.
- 04-02-2026Last modifiedVulnerability information updated.
Description
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service. This issue has been patched in version 1.1.1.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.03 pp
From 0.38% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Chainguard2 products
- dagdotdev< 0.0.20-r6
- apko≥ 0.14.8, < 1.1.1
Chainguard-dev1 product
- apko≥ 0.14.8, < 1.1.1
Chainguard.dev1 product
- apko≥ 0.14.8, < 1.1.1
Wolfi1 product
- dagdotdev< 0.0.20-r6
4 vendors · 5 products
References
4 links- github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6X Refsource CONFIRMAdvisoryThird Party Advisory
- github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09X Refsource MISCFIXPatch
