Skip to content
OpenAdvisories

Product · chainguard-dev

apko

10 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-105768

    apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root

    apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.…

    chainguard-dev apko
  • Medium 6.5
    CVE-2026-42576

    apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

    apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *rsa.PublicKey without checking the key type. If a repository …

    chainguard-dev apko chainguard.dev/apko Go
  • Medium 5.5
    CVE-2026-25122

    apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

    apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.0, expandapk.Split drains the first gzip stream of an APK archive via io.Copy(io.Discard, gzi) without explicit bounds. With an attacker-con…

    chainguard-dev apko chainguard.dev/apko Go