CVE-2026-25140: 
NixOS vulnerability analysis and mitigation

CVE-2026-25140 is a decompression bomb (zip bomb) vulnerability in Chainguard's apko, a tool for building OCI container images from APK packages. The flaw allows an attacker who controls or compromises an APK repository used by apko to cause unbounded resource exhaustion on the build host. Affected versions span from v0.14.8 up to (but not including) v1.1.1. The vulnerability was discovered by Oleh Konko (@1seal) from 1seal, disclosed on February 3, 2026, and patched in v1.1.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code resides in the ExpandApk function within pkg/apk/expandapk/expandapk.go, which decompresses .apk streams (gzip-compressed tar archives) without enforcing any size limits on the decompressed output. An attacker serving a malicious APK repository can craft a highly-compressed "decompression bomb" — a small .apk file that expands into an extremely large tar stream — causing the build host to exhaust disk space and CPU time. The fix (commit 2be3903) introduces LimitedReader wrappers around all external data sources, including APK index decompression, APK control/data sections, and HTTP response bodies, with configurable size limits exposed as CLI flags (GitHub Advisory, Fix Commit).

Successful exploitation results in a denial of service on the build host, with no impact to confidentiality or integrity. A malicious APK repository can cause apko to consume excessive disk space and CPU time during image builds, leading to build failures and potential disruption of CI/CD pipelines that rely on apko. Because apko is commonly used in automated container image build workflows, a compromised or attacker-controlled upstream APK repository could affect multiple build hosts across an organization's infrastructure (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.039% (12th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to control or compromise an APK repository that the target apko build process fetches packages from — a supply chain attack precondition that limits opportunistic exploitation (GitHub Advisory, Feedly).

1. Gain control of an APK repository: The attacker must either operate a malicious APK repository or compromise a legitimate one that is referenced in a target's apko build configuration.
2. Craft a decompression bomb: Create a small, highly-compressed .apk file (gzip-compressed tar archive) that expands to a very large tar stream when decompressed — for example, a file containing gigabytes of repeated null bytes compressed to a few kilobytes.
3. Serve the malicious package: Host the crafted .apk in the attacker-controlled repository, ensuring it appears as a valid package that apko would fetch during a build.
4. Trigger the build: Wait for or induce the target to run an apko build that references the malicious repository (e.g., via a dependency in the build configuration or a supply chain compromise).
5. Resource exhaustion occurs: When apko calls ExpandApk on the malicious .apk, it decompresses the stream without limits, consuming all available disk space and CPU on the build host, causing build failures or a full denial of service (GitHub Advisory).

• File System: Rapid and unexpected growth of temporary directories used by apko during builds (e.g., /tmp or configured temp paths); disk space exhaustion on build hosts coinciding with apko build execution.
• Process: Sustained high CPU utilization by the apko process during package expansion; build processes hanging or timing out during APK decompression steps.
• Logs: Build logs showing failures during APK expansion or package installation phases with disk-full or resource exhaustion errors; unexpected large file sizes in apko's working directories.
• Network: Outbound connections from build hosts to unfamiliar or unexpected APK repository URLs not present in the standard build configuration.

Upgrade apko to version v1.1.1 or later, which introduces configurable decompression size limits via LimitedReader wrappers on all external data sources. The patched version adds CLI flags to control limits: --max-apkindex-decompressed-size, --max-apk-control-size, --max-apk-data-size, and --max-http-response-size. As a workaround for environments that cannot immediately upgrade, restrict apko builds to only use trusted, verified APK repositories and implement network-level controls to prevent access to unauthorized package sources (GitHub Advisory, Fix Commit).

The vulnerability was coordinated and published by the Chainguard security team (coordinators: egibs, antitree, jdolitsky) and credited to Oleh Konko (@1seal) from 1seal for responsible disclosure. Red Hat also tracked the issue under their CVE database. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability database entries (GitHub Advisory, Red Hat).