Skip to content
OpenAdvisories

Package · Go

chainguard.dev/apko

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-42576

    apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

    apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository …

    chainguard-dev apko chainguard.dev/apko Go
  • Medium 5.5
    CVE-2026-25122

    apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

    apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-con…

    chainguard-dev apko chainguard.dev/apko Go