HIGH7.5Go
GHSA-5g94-c2wx-8pxw· CVE-2026-25121, GO-2026-4405apko has a path traversal in apko dirFS which allows filesystem writes outside base
Modified: 9/10/2026
package
Go/chainguard.dev/apko
pkg:go/chainguard.dev/apko
MEDIUM5.5Go
GHSA-6p9p-q6wh-9j89· CVE-2026-25122, GO-2026-4406apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
Modified: 9/10/2026
HIGH8.3Go
GHSA-fpg8-7664-jc5q· CVE-2026-54174, GO-2026-5968melange: Incomplete package integrity verification allows data section substitution
Modified: 9/10/2026
HIGH7.5Go
GHSA-hcwr-pq9g-rq3m· CVE-2026-42575, GO-2026-5422apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
Modified: 9/10/2026
MEDIUM6.5Go
GHSA-m7hm-vm4x-28jf· CVE-2026-42576, GO-2026-5497apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Modified: 9/10/2026
HIGH7.5Go
GHSA-qq3r-w4hj-gjp6· CVE-2026-42574, GO-2026-5589apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Modified: 9/10/2026
HIGH7.5Go
GHSA-v6mg-7f7p-qmqp· CVE-2024-36127, GO-2024-2899apko Exposure of HTTP basic auth credentials in log output
Modified: 9/10/2026
HIGH7.0Go
GHSA-x6ph-r535-3vjw· CVE-2025-53945, GO-2025-3816apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files
Modified: 9/10/2026
—Go
GO-2024-2899· CVE-2024-36127, GHSA-v6mg-7f7p-qmqpapko Exposure of HTTP basic auth credentials in log output in chainguard.dev/apko
Modified: 2/4/2026
—Go
GO-2025-3816· CVE-2025-53945, GHSA-x6ph-r535-3vjwapko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files in chainguard.dev/apko
Modified: 2/4/2026
—Go
GO-2026-4405· CVE-2026-25121, GHSA-5g94-c2wx-8pxwapko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko
Modified: 2/6/2026
—Go
GO-2026-4406· CVE-2026-25122, GHSA-6p9p-q6wh-9j89apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko
Modified: 2/6/2026
—Go
GO-2026-4410· CVE-2026-25140, GHSA-f4w5-5xv9-85f6apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko
Modified: 3/18/2026
—Go
GO-2026-5422· CVE-2026-42575, GHSA-hcwr-pq9g-rq3mapko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko
Modified: 7/22/2026
—Go
GO-2026-5497· CVE-2026-42576, GHSA-m7hm-vm4x-28jfapko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko
Modified: 7/22/2026
—Go
GO-2026-5589· CVE-2026-42574, GHSA-qq3r-w4hj-gjp6apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko
Modified: 6/25/2026
—Go
GO-2026-5968· CVE-2026-54174, GHSA-fpg8-7664-jc5qmelange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko
Modified: 7/22/2026