ExpandApk in Apko expands .apk streams without a decompression limit, allowing a malicious repository that serves a small, highly‑compressed .apk to inflate into a large tar stream. This can consume excessive disk space and CPU time during image build, potentially causing build failures or a denial of service.

Chainguard's Apko, from version 0.14.8 up to but not including 1.1.1, is affected. Systems using the vulnerable version of Apko and fetching packages from an attacker‑controlled or compromised APK repository are at risk.

With a CVSS score of 7.5 the vulnerability carries a moderate severity. The EPSS score is below 1 % indicating a low likelihood of exploitation in the wild, and the issue is not currently listed in the CISA KEV catalog. The attack requires an attacker to control or compromise the APK repository used by Apko; they can then serve the compressed .apk to trigger resource exhaustion on the build host.