chainguard-dev apko vulnerabilities

CVEs per yearBy the year they were published

1. 20241
2. 20251
3. 20268

Newest CVEs

• CVE-2026-105768

  apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root

  chainguard-dev · apko

  Medium6.3
• CVE-2026-54174

  melange: Incomplete package integrity verification allows data section substitution

  chainguard-dev · melange

  High8.3
• CVE-2026-42576

  apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery

  chainguard-dev · apko

  Medium6.5
• CVE-2026-42575

  apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

  chainguard-dev · apko

  High7.5
• CVE-2026-42574

  apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

  chainguard-dev · apko

  High7.5
• CVE-2026-25140

  apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

  chainguard-dev · apko

  High7.5
• CVE-2026-25121

  apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base

  chainguard-dev · apko

  High7.5
• CVE-2026-25122

  apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams

  chainguard-dev · apko

  Medium5.5
• CVE-2025-53945

  apko has incorrect permission (0666) in /etc/ld.so.cache and other files

  chainguard-dev · apko

  High7.0
• CVE-2024-36127

  apko Exposure of HTTP basic auth credentials in log output

  chainguard-dev · apko

  High7.5