Vulnerabilities in a published Broka version: which versions carry them, whether they reach Broka, and what to install. Fixes land on the latest release line. To report one, see the community page.
Image scanners report four high-severity CVEs in the console image of 1.0.0 through 1.3.1: three in nginx 1.30.5, its web server, each needing an nginx configuration BROKA does not have, and one in the Brotli library, which nothing in the running console uses. 1.3.2 runs nginx 1.30.6 and Brotli 1.2.1, which fix all four.
Image scanners report two high-severity CVEs in the console image of 1.0.0 through 1.3.0: libexpat and libX11, both pulled in only for nginx's image-filter module, which BROKA never loads. 1.3.1 carries the fixed versions of both.
Microsoft's October 2026 .NET and ASP.NET Core advisories apply to the .NET 10.0.12 runtime of the Orchestrator in 1.0.0 through 1.2.1. Nine do not reach BROKA as shipped; three do — a crafted date filter from a signed-in user can end the Orchestrator, a multipart body can make it reserve far more memory than it was sent, and a client that disconnects mid-request can have a request hidden in its body processed. 1.3.0 runs on .NET 10.0.13, which fixes all twelve.
Microsoft's 13 October 2026 advisories for System.Security.Cryptography.Xml and System.Security.Cryptography.Pkcs apply to the .NET 10.0.12 runtime in the Orchestrator images of 1.0.0 through 1.2.1. All five are denial-of-service flaws in XML signature and encryption and in CMS processing, which BROKA never performs; 1.3.0 runs on .NET 10.0.13.
Image scanners report five high-severity CVEs in the broker service and console images of 1.0.0 through 1.1.2: lz4-java, the Go standard library inside an unused binary, and libtiff. None is reachable in the way BROKA ships; 1.2.0 removes all five.
