CVE-2026-25122
📋 TL;DR
This vulnerability in apko allows attackers to cause resource exhaustion by forcing excessive CPU usage during gzip inflation of malicious APK archives. It affects users who process untrusted APK streams with apko versions 0.14.8 through 1.0.x. The impact is denial of service through CPU exhaustion.
💻 Affected Systems
- apko
📦 What is this software?
Apko by Chainguard
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, causing timeouts and process crashes in container build pipelines.
Likely Case
Degraded performance and timeouts in CI/CD pipelines processing untrusted APK packages, disrupting container image builds.
If Mitigated
Minimal impact if only trusted APK sources are processed or if resource limits are strictly enforced.
🎯 Exploit Status
Exploitation requires attacker to supply malicious APK input to vulnerable apko instance. No authentication needed if input processing is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.0
Vendor Advisory: https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89
Restart Required: No
Instructions:
1. Update apko to version 1.1.0 or later. 2. For containerized deployments, rebuild images with updated apko version. 3. Verify the fix by checking version with 'apko version'.
🔧 Temporary Workarounds
Resource Limiting
allApply CPU and memory limits to apko processes to mitigate resource exhaustion impact
docker run --cpus="1.0" --memory="512m" ...
systemd: CPUQuota=100%
k8s: resources.limits.cpu: "1"
Input Validation
allOnly process APK archives from trusted sources and validate inputs before processing
🧯 If You Can't Patch
- Implement strict input validation to only accept APK packages from trusted sources
- Deploy resource monitoring and alerting for abnormal CPU usage patterns in apko processes
🔍 How to Verify
Check if Vulnerable:
Check apko version: if between 0.14.8 and 1.0.x inclusive, system is vulnerableCheck Version:
apko versionVerify Fix Applied:
Verify apko version is 1.1.0 or later using 'apko version' command📡 Detection & Monitoring
Log Indicators:
- Unusually high CPU usage by apko processes
- Timeout errors in container build pipelines
- Process crashes during APK processing
Network Indicators:
- High volume of APK downloads from untrusted sources to apko instances
SIEM Query:
process.name:"apko" AND cpu.usage > 90% sustained for >30s