CVE-2026-25122: apko Container Image Tool DoS Vulnerability

CVE-2026-25122 Overview

A resource exhaustion vulnerability has been identified in apko, a tool that allows users to build and publish OCI container images built from apk packages. The vulnerability exists in the expandapk.Split function which drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. When processing attacker-controlled input streams, this can force large gzip inflation work, leading to resource exhaustion and availability impact.

Critical Impact
An attacker can craft malicious APK archives that cause excessive CPU consumption during gzip inflation, potentially leading to denial of service conditions through process slowdown or timeouts.

Affected Products

apko versions 0.14.8 to before 1.1.0
OCI container image build pipelines using vulnerable apko versions
Systems processing untrusted APK streams with apko

Discovery Timeline

2026-02-04 - CVE CVE-2026-25122 published to NVD
2026-02-05 - Last updated in NVD database

Technical Details for CVE-2026-25122

Vulnerability Analysis

The vulnerability resides in the Split function within apko's APK archive handling code. The function reads the first tar header from an APK archive, then drains the remainder of the gzip stream by reading directly from the gzip reader. The critical flaw is the absence of any maximum uncompressed byte limit or inflate-ratio cap, which means the function will process gzip data until the stream is exhausted, regardless of the output size.

This allows for a classic gzip bomb attack vector where a small compressed payload can expand to an enormous size during decompression. When a caller parses attacker-controlled APK streams, the system may be forced to spend excessive CPU time inflating maliciously crafted gzip data, resulting in denial of service conditions.

Root Cause

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption). The expandapk.Split function lacks defensive programming measures such as:

Maximum uncompressed byte limits
Inflate ratio caps to detect gzip bombs
Timeout mechanisms for decompression operations
Resource consumption monitoring during stream processing

Without these safeguards, the function is vulnerable to algorithmic complexity attacks where the computational cost of processing input significantly exceeds the input size.

Attack Vector

The attack requires local access with user interaction (processing a malicious APK file). An attacker would craft a specially designed APK archive containing gzip-compressed data with an extremely high compression ratio. When a victim processes this archive using a vulnerable apko version, the Split function will attempt to decompress the malicious stream, consuming excessive CPU resources.

The security patch introduces limit readers for readers that consume data from external sources, as shown in the fix:

 	"chainguard.dev/apko/pkg/build"
 	"chainguard.dev/apko/pkg/build/types"
 	"chainguard.dev/apko/pkg/cpio"
+	"chainguard.dev/apko/pkg/options"
 )
 
 func buildCPIO() *cobra.Command {

Source: GitHub Commit Update

The patch adds the options package import which contains limit reader implementations to bound resource consumption when processing external data sources.

Detection Methods for CVE-2026-25122

Indicators of Compromise

Unusual CPU spikes during APK archive processing
Process timeouts or unresponsive container build operations
Memory pressure or OOM events in apko build pipelines
Abnormally large or suspiciously structured APK files in build directories

Detection Strategies

Monitor apko process CPU utilization for anomalous sustained high usage
Implement file size and compression ratio checks on incoming APK archives
Set up alerts for build pipeline timeouts that may indicate resource exhaustion attacks
Review logs for repeated failed or stalled APK processing operations

Monitoring Recommendations

Enable resource monitoring on systems running apko build operations
Implement rate limiting and resource quotas for APK processing workloads
Configure alerting thresholds for CPU and memory consumption in CI/CD pipelines
Track and analyze APK file characteristics before processing in production environments

How to Mitigate CVE-2026-25122

Immediate Actions Required

Upgrade apko to version 1.1.0 or later immediately
Audit systems for vulnerable apko versions between 0.14.8 and 1.1.0
Review container build pipelines that process untrusted APK sources
Implement resource limits on apko processes until patching is complete

Patch Information

The vulnerability has been patched in apko version 1.1.0. The fix introduces limit readers for all readers that consume data from external sources, preventing unbounded resource consumption during gzip inflation. The patch is available via GitHub Commit 2be3903. Additional details are provided in the GitHub Security Advisory GHSA-6p9p-q6wh-9j89.

Workarounds

Implement process-level resource limits (cgroups, ulimits) for apko operations
Pre-validate APK archives for suspicious compression ratios before processing
Use timeout wrappers around apko build commands to prevent indefinite hangs
Isolate APK processing in resource-constrained containers or sandboxes

bash

# Configuration example - Set resource limits for apko processes
# Using ulimit to restrict CPU time
ulimit -t 300  # Limit CPU time to 300 seconds

# Using cgroups v2 to limit resources
systemd-run --scope -p CPUQuota=50% -p MemoryMax=2G apko build config.yaml image.tar