- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 9 · 7 high, 2 medium
- Registry
- pkg.go.dev
Advisories 9
- CVE-2026-54174High 8.3
melange: Incomplete package integrity verification allows data section substitution
Affected: fixed in 1.2.9.
- CVE-2026-42576Medium 6.5
apko `DiscoverKeys` has a panic on non-rsa jwks key that causes crash during key discovery
Affected: fixed in 1.2.7.
- CVE-2026-42575High 7.5
apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)
Affected: fixed in 1.2.7.
- CVE-2026-42574High 7.5
apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root
Affected: from 0.14.8, fixed in 1.2.5.
- CVE-2026-25140High 7.5
apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams
Affected: from 0.14.8, fixed in 1.1.1.
- CVE-2026-25121High 7.5
apko is vulnerable to path traversal in apko dirFS which allows filesystem writes outside base
Affected: from 0.14.8, fixed in 1.1.0.
- CVE-2026-25122Medium 5.5
apko is vulnerable to unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams
Affected: from 0.14.8, fixed in 1.1.0.
- CVE-2025-53945High 7.0
apko has incorrect permission (0666) in /etc/ld.so.cache and other files
Affected: from 0.27.0, fixed in 0.29.5.
- CVE-2024-36127High 7.5
apko Exposure of HTTP basic auth credentials in log output
Affected: fixed in 0.14.5.