libexpat and libX11 findings in the 1.0.0–1.3.0 console images
Image scanners report two high-severity CVEs in the console image of 1.0.0 through 1.3.0: libexpat and libX11, both pulled in only for nginx's image-filter module, which BROKA never loads. 1.3.1 carries the fixed versions of both.
Not exploitable in any configuration BROKA ships
- Affected
- 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0
- Fixed in
- 1.3.1
- Editions
- Community and Commercial
- Severity
- High
- CVEs
- CVE-2026-77214, CVE-2026-88806
What was found
Image scanners report two high-severity vulnerabilities in the console image — the nginx image that serves BROKA's web console — of every version from 1.0.0 to 1.3.0:
| Component | Image | CVE | Upstream severity | In BROKA |
|---|---|---|---|---|
| libexpat 2.8.x | Console | CVE-2026-77214 | High | never run |
| libX11 1.8.13 | Console | CVE-2026-88806 | High | never run |
Both editions are affected the same way: Community 1.0.0 through 1.3.0, and Commercial 1.0.1 through 1.3.0. The broker service and Orchestrator images carry neither.
Why neither reaches BROKA
libexpat — CVE-2026-77214
A heap buffer over-read in libexpat's XML parser can disclose memory when it parses a crafted XML document. In the console image libexpat is there only because fontconfig needs it, and fontconfig only because of libgd, the image library behind nginx's optional image-filter module. BROKA's nginx configuration loads no optional module, and nginx itself parses no XML, so libexpat is never called.
libX11 — CVE-2026-88806
A heap buffer overflow in libX11 can be triggered by a malicious X server that a program connects to. libX11 is in the console image for the same reason as libexpat — libgd, through libXpm, libXext and libXt — and is never loaded. The console never opens a connection to an X server either.
What to do
Upgrade to 1.3.1 or later. Its console image carries libexpat 2.9.0 and libX11 1.8.14, which fix both; an upgrade is new images and a restart, and the 1.3.1 release notes have the details. No earlier version needs a workaround in the meantime.
Scanners that read OpenVEX can take this advisory's statements from the document linked on this page, which names each affected image by digest.
Timeline
- 2026-10-20: the nightly scan of 1.3.0's published images reports both.
- 2026-10-21: 1.3.1 is released with the fixed versions.
- 2026-10-24: this advisory is published.