{"schema_version":"1.7.3","id":"GHSA-6p9p-q6wh-9j89","published":"2026-02-03T23:58:37Z","modified":"2026-02-23T23:43:50.057274Z","aliases":["CVE-2026-25122","GO-2026-4406"],"related":["CGA-f3vx-5mgf-mh7c"],"summary":"apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams ","details":"`expandapk.Split` drains the first gzip stream of an APK archive via `io.Copy(io.Discard, gzi)` without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact).                                                                                                                      \n                                                                                                                                                                                              \nThe `Split` function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown.             \n                                                                                                                                                                                              \n**Fix:** Fixed with [2be3903](https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09), Released in v1.1.0.                                                  \n                                                                                                                                                                                              \n**Acknowledgements**                                                                                                                                                                        \n                                                                                                                                                                                             \napko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.","affected":[{"package":{"name":"chainguard.dev/apko","ecosystem":"Go","purl":"pkg:golang/chainguard.dev/apko"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.14.8"},{"fixed":"1.1.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-6p9p-q6wh-9j89/GHSA-6p9p-q6wh-9j89.json"}}],"references":[{"type":"WEB","url":"https://github.com/chainguard-dev/apko/security/advisories/GHSA-6p9p-q6wh-9j89"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25122"},{"type":"WEB","url":"https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09"},{"type":"PACKAGE","url":"https://github.com/chainguard-dev/apko"}],"database_specific":{"cwe_ids":["CWE-400","CWE-770"],"github_reviewed":true,"github_reviewed_at":"2026-02-03T23:58:37Z","nvd_published_at":"2026-02-04T19:16:14Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}