chainguard.dev/apko vulnerabilities
CVEs whose affected-version data names the chainguard.dev/apko package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-42576Noneapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
▾ Sunlitapko · chainguard.dev/apkoEPSS 0.25%via OSV
CVE-2026-42575Noneapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
▾ Sunlitapko · chainguard.dev/apkoEPSS 0.16%via OSV
CVE-2026-25122Medium· 5.5apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
▾ Sunlitapko · chainguard.dev/apkoEPSS 0.11%via OSV
CVE-2026-25121High· 7.5apko has a path traversal in apko dirFS which allows filesystem writes outside base
apko has a path traversal in apko dirFS which allows filesystem writes outside base
▾ Twilightapko · chainguard.dev/apkoEPSS 0.38%via OSV