Repository navigation
[Bug][Build] v1.0.3-beta18 images contain brotli vulnerable to CVE-2026-111497 (Critical) #9258
Description
Search before asking
- I had searched in the issues and found no similar issues.
What happened
All three v1.0.3-beta18 images contain a Brotli library that is vulnerable to CVE-2026-111497. Security scanners flag the images as Critical. Our admission policy (Wiz) blocks the images. We had to stop our DevLake deployment (Kubernetes, Helm).
v1.0.3-beta18 is the latest release. No released image contains the fix.
The vulnerability
- Out-of-bounds write in the Brotli decoder (
c/dec/decode.c), CWE-787. - A remote attacker without authentication can use a crafted stream to disclose memory, cause a denial of service, or possibly execute code.
- CVSS v4.0: 9.2 Critical (score from the CNA, Google).
- Affected: Brotli 1.0.3 to 1.2.0. Fixed: 1.0.10, 1.1.1, 1.2.1 (released 2026-10-21).
Sources:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-111497
- Brotli fix releases: v1.2.1, v1.1.1, v1.0.10
- Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2026-111497
- Alpine secdb (fix in
brotli 1.2.1-r0): https://secdb.alpinelinux.org/v3.24/main.json - Node.js security release for the same CVE: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
Affected images (tag v1.0.3-beta18, linux/amd64, pushed 2026-09-27)
| Image | Base | Package | Installed | Fixed |
|---|---|---|---|---|
apache/devlake |
Debian 12 (python:3.11-slim-bookworm) |
libbrotli1 |
1.0.9-2+b6 |
1.0.9-2+deb12u1 (DLA-4855-1) |
apache/devlake-config-ui |
Debian 13 (nginxinc/nginx-unprivileged:1.31.5) |
libbrotli1 |
1.1.0-2+b7 |
1.1.0-2+deb13u1 (DSA-6582-1) |
apache/devlake-dashboard |
Alpine 3.24.1 (grafana/grafana:13.2.2) |
brotli-libs |
1.2.0-r1 |
1.2.1-r0 |
In the two Debian images, libcurl4 / libcurl4t64 and libfreetype6 depend on libbrotli1.
What do you expect to happen
The current release images contain the fixed Brotli packages, so that security scanners do not block them. A new release or a re-push of v1.0.3-beta18 is sufficient for us.
How to reproduce
Show the installed Brotli package in each image:
docker run --rm --entrypoint dpkg-query apache/devlake:v1.0.3-beta18 -W libbrotli1
docker run --rm --entrypoint dpkg-query apache/devlake-config-ui:v1.0.3-beta18 -W libbrotli1
docker run --rm --entrypoint apk apache/devlake-dashboard:v1.0.3-beta18 info -v brotli-libsCompare the versions with the "Fixed" column above. A scanner (for example Trivy or Wiz) reports CVE-2026-111497 for all three images.
Anything else
A rebuild with pinned base tags does not change the packages that come from the base image. Use base tags that contain the fix, or add apt-get upgrade / apk upgrade to the Dockerfiles.
Version
v1.0.3-beta18
Are you willing to submit PR?
- Yes I am willing to submit a PR!
Code of Conduct
- I agree to follow this project's Code of Conduct
Activity
DoDiODev commentedon Oct 27, 2026
Thanks for the detailed report. I can confirm it, and newer base tags do not fix it yet:
nginxinc/nginx-unprivileged:1.31.7(the bump in Dependabot build(deps): bump the docker-patch group across 2 directories with 2 updates #9253) still shipslibbrotli1 1.1.0-2+b7grafana/grafana:13.2.4(currentmain) still shipsbrotli-libs 1.2.0-r1#9264 adds
apt-get upgrade/apk upgradeto the three Dockerfiles, as you suggested. Local builds of the PR branch contain the fixed packages:devlakelibbrotli1 1.0.9-2+deb12u1devlake-config-uilibbrotli1 1.1.0-2+deb13u1devlake-dashboardbrotli-libs 1.2.1-r0A maintainer still needs to publish new images (a new release or a re-push of
v1.0.3-beta18) after the merge.fix(docker): upgrade OS packages in release images (apache#9264)