---
id: CVE-2026-25122
aliases:
  - GHSA-6p9p-q6wh-9j89
  - GO-2026-4406
title: >-
  apko affected by unbounded resource consumption in expandapk.Split on
  attacker-controlled .apk streams 
summary: >-
  apko affected by unbounded resource consumption in expandapk.Split on
  attacker-controlled .apk streams 
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: apko
product: chainguard.dev/apko
ecosystem: go
affected:
  - 'chainguard.dev/apko >= 0.14.8, < 1.1.0'
patched:
  - chainguard.dev/apko 1.1.0
published: '2026-02-03'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:48.412365885Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6p9p-q6wh-9j89'
references:
  - url: >-
      https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-25122'
  - url: >-
      https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09
  - url: 'https://github.com/chainguard-dev/apko'
tags:
  - osv
  - go
epss: 0.00112
epssPercentile: 0.01258
ingestedAt: '2026-09-12T03:13:01.760Z'
---

## Overview

`expandapk.Split` drains the first gzip stream of an APK archive via `io.Copy(io.Discard, gzi)` without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact).                                                                                                                      
                                                                                                                                                                                              
The `Split` function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown.             
                                                                                                                                                                                              
**Fix:** Fixed with [2be3903](https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09), Released in v1.1.0.                                                  
                                                                                                                                                                                              
**Acknowledgements**                                                                                                                                                                        
                                                                                                                                                                                             
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.

## Affected packages

- `chainguard.dev/apko >= 0.14.8, < 1.1.0`

## Remediation

Upgrade to a patched release:

- `chainguard.dev/apko 1.1.0`