chainguard.dev/apko
Activity
- Latest release
- 6h ago
- Total releases
- 78
- Cadence
- ~3 days
- Last 12 months
- 46
Details
- First release
- Mar 18, 2022
| Version | Released | |
|---|---|---|
v1.4.1
patch
|
v1.4.1
patch
Dependencies (36)
+ 28 more |
|
v1.4.0
minor
|
v1.4.0
minor
Dependencies (36)
+ 28 more |
|
v1.3.1
patch
|
v1.3.1
patch
Dependencies (36)
+ 28 more |
|
v1.3.0
minor
|
v1.3.0
minor
Dependencies (36)
+ 28 more |
|
v1.2.45
patch
|
v1.2.45
patch
Dependencies (36)
+ 28 more |
|
v1.2.44
patch
|
v1.2.44
patch
Dependencies (35)
+ 27 more |
|
v1.2.43
patch
|
v1.2.43
patch
Dependencies (35)
+ 27 more |
|
v1.2.42
patch
|
v1.2.42
patch
Dependencies (35)
+ 27 more |
|
v1.2.41
patch
|
v1.2.41
patch
Dependencies (35)
+ 27 more |
|
v1.2.40
patch
|
v1.2.40
patch
Dependencies (34)
+ 26 more |
|
v1.2.39
patch
|
v1.2.39
patch
Dependencies (34)
+ 26 more |
|
v1.2.38
patch
|
v1.2.38
patch
Dependencies (34)
+ 26 more |
|
v1.2.37
patch
|
v1.2.37
patch
Dependencies (33)
+ 25 more |
|
v1.2.36
patch
|
v1.2.36
patch
Dependencies (33)
+ 25 more |
|
v1.2.35
patch
|
v1.2.35
patch
Dependencies (33)
+ 25 more |
|
v1.2.34
patch
|
v1.2.34
patch
Dependencies (33)
+ 25 more |
|
v1.2.33
patch
|
v1.2.33
patch
Dependencies (33)
+ 25 more |
|
v1.2.32
patch
|
v1.2.32
patch
Dependencies (33)
+ 25 more |
|
v1.2.31
patch
|
v1.2.31
patch
Dependencies (33)
+ 25 more |
|
v1.2.30
patch
|
v1.2.30
patch
Dependencies (33)
+ 25 more |
|
v1.2.29
patch
|
v1.2.29
patch
Dependencies (33)
+ 25 more |
|
v1.2.28
patch
|
v1.2.28
patch
Dependencies (33)
+ 25 more |
|
v1.2.27
patch
|
v1.2.27
patch
Dependencies (33)
+ 25 more |
|
v1.2.26
patch
|
v1.2.26
patch
Dependencies (33)
+ 25 more |
|
v1.2.25
patch
|
v1.2.25
patch
Dependencies (33)
+ 25 more |
|
v1.2.24
patch
|
v1.2.24
patch
Dependencies (33)
+ 25 more |
|
v1.2.23
patch
|
v1.2.23
patch
Dependencies (33)
+ 25 more |
|
v1.2.22
patch
|
v1.2.22
patch
Dependencies (33)
+ 25 more |
|
v1.2.21
patch
|
v1.2.21
patch
Dependencies (33)
+ 25 more |
|
v1.2.20
patch
|
v1.2.20
patch
Dependencies (33)
+ 25 more |
|
v1.2.19
patch
|
v1.2.19
patch
Dependencies (33)
+ 25 more |
|
v1.2.18
patch
|
v1.2.18
patch
Dependencies (33)
+ 25 more |
|
v1.2.17
patch
|
v1.2.17
patch
Dependencies (33)
+ 25 more |
|
v1.2.16
patch
|
v1.2.16
patch
Dependencies (32)
+ 24 more |
|
v1.2.13
patch
|
v1.2.13
patch
Dependencies (32)
+ 24 more |
|
v1.2.11
minor
|
v1.2.11
minor
Dependencies (32)
+ 24 more |
|
v1.1.15
patch
4 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev |
v1.1.15
patch
Dependencies (32)
+ 24 more |
|
v1.1.14
patch
4 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev |
v1.1.14
patch
Dependencies (32)
+ 24 more |
|
v1.1.13
patch
4 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev |
v1.1.13
patch
Dependencies (32)
+ 24 more |
|
v1.1.9
patch
4 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev |
v1.1.9
patch
Dependencies (32)
+ 24 more |
|
v1.1.8
patch
4 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev |
v1.1.8
patch
Dependencies (32)
+ 24 more |
|
v1.1.7
patch
4 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev |
v1.1.7
patch
Dependencies (32)
+ 24 more |
|
v1.1.0
minor
5 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev |
v1.1.0
minor
Dependencies (32)
+ 24 more |
|
v1.0.1
major
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v1.0.1
major
Dependencies (32)
+ 24 more |
|
v0.30.33
patch
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v0.30.33
patch
Dependencies (31)
+ 23 more |
|
v0.30.24
patch
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v0.30.24
patch
Dependencies (31)
+ 23 more |
|
v0.30.13
patch
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v0.30.13
patch
Dependencies (31)
+ 23 more |
|
v0.30.11
patch
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v0.30.11
patch
Dependencies (31)
+ 23 more |
|
v0.30.4
patch
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v0.30.4
patch
Dependencies (31)
+ 23 more |
|
v0.30.2
patch
7 CVEs
CVE-2026-54174
GO-2026-5968
GHSA-fpg8-7664-jc5q
Jul 17, 2026
melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko melange: Incomplete package integrity verification allows data section substitution in chainguard.dev/apko Fixed in
1.2.9
Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42574
GO-2026-5589
GHSA-qq3r-w4hj-gjp6
Jun 25, 2026
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root in chainguard.dev/apko Fixed in
1.2.5
References
Updated Jun 25, 2026 · Source: OSV.dev
CVE-2026-42576
GO-2026-5497
GHSA-m7hm-vm4x-28jf
Jun 25, 2026
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery in chainguard.dev/apko apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-42575
GO-2026-5422
GHSA-hcwr-pq9g-rq3m
Jun 25, 2026
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible) in chainguard.dev/apko Fixed in
1.2.7
References Updated Jul 22, 2026 · Source: OSV.dev
CVE-2026-25140
GO-2026-4410
GHSA-f4w5-5xv9-85f6
Feb 26, 2026
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.1
References Updated Mar 18, 2026 · Source: OSV.dev
CVE-2026-25121
GO-2026-4405
GHSA-5g94-c2wx-8pxw
Feb 05, 2026
apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko apko has a path traversal in apko dirFS which allows filesystem writes outside base in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev
CVE-2026-25122
GO-2026-4406
GHSA-6p9p-q6wh-9j89
Feb 05, 2026
apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams in chainguard.dev/apko Fixed in
1.1.0
References Updated Feb 06, 2026 · Source: OSV.dev |
v0.30.2
patch
Dependencies (31)
+ 23 more |