CVE-2026-105768 apko /etc/passwd and /etc/group UID/GID truncation writes package-supplied entries as root

apko allows users to build and publish OCI container images built from apk packages. From version 0.2.0 to before version 1.4.5, UserEntry.Parse and GroupEntry.Parse in pkg/passwd read the UID and GID fields of /etc/passwd and /etc/group entries with strconv.Atoi and convert them to uint32 withou...

CVE-2026-105768

The apko tool, used to build OCI container images from apk packages, is vulnerable to a numeric truncation error (CWE-197) in versions 0.2.0 to before 1.4.5 . Specifically, the UserEntry.Parse and GroupEntry.Parse functions in pkg/passwd use strconv.Atoi to convert UID and GID fields to uint32 wi...

PT-2026-83436

Name of the Vulnerable Software and Affected Versions su-exec versions prior to 0.4 Description The software fails to validate numeric user and group identifiers parsed with the strtol function before assigning them to uid t and gid t types. This allows out-of-range values to be truncated to zero...