{"id":"CVE-2026-25122","aliases":["GHSA-6p9p-q6wh-9j89","GO-2026-4406"],"title":"apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams ","summary":"apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams ","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","vendor":"apko","product":"chainguard.dev/apko","ecosystem":"go","affected":["chainguard.dev/apko >= 0.14.8, < 1.1.0"],"patched":["chainguard.dev/apko 1.1.0"],"published":"2026-02-03","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:48.412365885Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-6p9p-q6wh-9j89","references":[{"url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25122"},{"url":"https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09"},{"url":"https://github.com/chainguard-dev/apko"}],"tags":["osv","go"],"epss":0.00112,"epssPercentile":0.01258,"ingestedAt":"2026-09-12T03:13:01.760Z","slug":"CVE-2026-25122","body":"## Overview\n\n`expandapk.Split` drains the first gzip stream of an APK archive via `io.Copy(io.Discard, gzi)` without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact).                                                                                                                      \n                                                                                                                                                                                              \nThe `Split` function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown.             \n                                                                                                                                                                                              \n**Fix:** Fixed with [2be3903](https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09), Released in v1.1.0.                                                  \n                                                                                                                                                                                              \n**Acknowledgements**                                                                                                                                                                        \n                                                                                                                                                                                             \napko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.\n\n## Affected packages\n\n- `chainguard.dev/apko >= 0.14.8, < 1.1.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `chainguard.dev/apko 1.1.0`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}