apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromise…

A resource exhaustion vulnerability in apko, a tool for building OCI container images from APK packages, affects versions 0.14.8 to before 1.1.1. Attackers controlling or compromising APK repositories can exploit the ExpandApk function's lack of decompression limits to serve small, highly-compressed APK files that expand into large tar streams. This causes excessive disk space and CPU consumption, leading to build failures or denial of service. The vulnerability has been patched in version 1.1.1.