A resource exhaustion vulnerability in apko, a tool for building OCI container images from APK packages, affects versions 0.14.8 to before 1.1.1. Attackers controlling or compromising APK repositories can exploit the ExpandApk function's lack of decompression limits to serve small, highly-compressed APK files that expand into large tar streams. This causes excessive disk space and CPU consumption, leading to build failures or denial of service. The vulnerability has been patched in version 1.1.1.