5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-25122

CVE-2026-25122: apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact).

The Split function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown.

Fix: Fixed with 2be3903, Released in v1.1.0.

Acknowledgements

apko thanks Oleh Konko from 1seal for discovering and reporting this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-25122

CVE-2026-25122:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
chainguard.dev/apko	go	>= 0.14.8, < 1.1.0	1.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the processing of gzip-compressed streams from external sources (APK files and repository indexes) without proper size limits. The core issue is the use of io.Copy and gzip.NewReader on untrusted data, which can be exploited using "gzip bombs"—small, highly compressed files that decompress to a very large size. This leads to excessive CPU and memory usage, causing a denial of service.

The patch addresses this by introducing a new package, limitio, which provides a size-limited reader. This limited reader is then applied in all the functions that process external gzip streams:

expandapk.Split: The function that splits an APK into its components. The patch adds a limit when reading the signature and control data streams.
expandapk.ExpandApk: The function that expands an APK. The patch adds limits when reading both the control and data sections of the APK.
apk.IndexFromArchive: The function that parses repository indexes. The patch adds a limit to the size of the decompressed index.

By identifying these functions, we can pinpoint the exact locations in the code that would be exercised during an exploit. A runtime profiler would show these functions consuming significant resources when processing a malicious file.

Vulnerable functions

expandapk.Split

pkg/apk/expandapk/split.go

The `Split` function (refactored to `splitWithOptions` in the patch) was vulnerable to unbounded resource consumption. It used `io.Copy` to discard a gzip stream from an APK without any size limits. An attacker could provide a specially crafted APK (a gzip bomb) that would cause the application to consume excessive CPU and memory during decompression, leading to a denial of service.

expandapk.ExpandApk

pkg/apk/expandapk/expandapk.go

The `ExpandApk` function (refactored to `ExpandApkWithOptions` in the patch) was vulnerable in two ways. First, it discarded a gzip stream without limits, similar to `Split`. Second, it processed the data section of the APK, which could also be a gzip bomb, without any limits on the decompressed size. The patch adds size limits to both operations.

apk.IndexFromArchive

pkg/apk/apk/apkindex.go

The `IndexFromArchive` function parses a gzipped APKINDEX file. It was vulnerable to gzip bombs as it used `gzip.NewReader` to decompress the index archive without imposing any limits on the output size. This could be exploited by a malicious repository providing a compressed index that expands to an extremely large size.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.