Security
فارسی
All products

chainguard.dev/apko

Go · Package
9 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootCVE-2026-42574 · GHSA-QQ3R-W4HJ-GJP6Version ranges need review. chainguard.dev/apko Go High Fix reported
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discoveryCVE-2026-42576 · GHSA-M7HM-VM4X-28JFVersion ranges need review. chainguard.dev/apko Go Medium Fix reported
apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other filesCVE-2025-53945 · GHSA-X6PH-R535-3VJWVersion ranges need review. chainguard.dev/apko Go High Fix reported
melange: Incomplete package integrity verification allows data section substitutionCVE-2026-54174 · GHSA-FPG8-7664-JC5QVersion ranges need review. chainguard.dev/apkochainguard.dev/melange Go High Fix reported
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)CVE-2026-42575 · GHSA-HCWR-PQ9G-RQ3MVersion ranges need review. chainguard.dev/apko Go High Fix reported
apko has a path traversal in apko dirFS which allows filesystem writes outside baseCVE-2026-25121 · GHSA-5G94-C2WX-8PXWVersion ranges need review. chainguard.dev/apko Go High Fix reported
apko Exposure of HTTP basic auth credentials in log outputCVE-2024-36127 · GHSA-V6MG-7F7P-QMQPVersion ranges need review. chainguard.dev/apko Go High Fix reported
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams CVE-2026-25122 · GHSA-6P9P-Q6WH-9J89Version ranges need review. chainguard.dev/apko Go Medium Fix reported
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streamsCVE-2026-25140 · GHSA-F4W5-5XV9-85F6Version ranges need review. chainguard-dev/apkochainguard.dev/apko Go High Fix reported