Snappy, Guava and Brotli findings in the 1.0.0–1.3.2 broker service images
Image scanners report four high-severity CVEs in the broker service image of 1.0.0 through 1.3.2. One is reachable: snappy-java 1.1.10.7 can be made to allocate up to 2 GB while the broker service decompresses a crafted Snappy batch read from a Kafka topic, which stops the service until it restarts. The other three — a second snappy-java defect, one in Guava and one in the base image's Brotli library — are in code the service never runs with outside input. 1.3.3 fixes all four.
One denial of service reachable through a Kafka topic; the other three findings are not reachable
- Affected
- 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2
- Fixed in
- 1.3.3
- Editions
- Community and Commercial
- Severity
- High
- CVEs
- CVE-2026-108106, CVE-2026-93451, CVE-2026-102554, CVE-2026-111497
What was found
Image scanners report four high-severity vulnerabilities in the broker service image — the image that connects BROKA to your Kafka, Redis, RabbitMQ, Apache Artemis and Memcached servers — of every version from 1.0.0 to 1.3.2:
| Component | Image | CVE | Upstream severity | In BROKA |
|---|---|---|---|---|
| snappy-java 1.1.10.7 | Broker service | CVE-2026-108106 | High | reachable |
| snappy-java 1.1.10.7 | Broker service | CVE-2026-93451 | High | not reachable |
| Guava 32.1.3 | Broker service | CVE-2026-102554 | High | not reachable |
| Brotli 1.2.0 | Broker service | CVE-2026-111497 | High | never run |
Both editions are affected the same way: Community 1.0.0 through 1.3.2, and Commercial 1.0.1 through 1.3.2. The Orchestrator and console images carry none of them.
The one that reaches BROKA
A Snappy batch that declares a huge size — CVE-2026-108106
snappy-java, the library Kafka's client uses for Snappy compression, allocates the memory a compressed block says it will need before it reads the block — up to 2 GB, from a few bytes of input. The broker service decompresses a topic's batches whenever it reads messages: when someone browses or searches a topic, and when it works out how far behind a consumer group is in time, which the consumer group list, alert rules and metric history ask for on their own.
Someone who can produce to one of your topics could therefore write a batch that, once a Kafka broker has accepted and stored it, exhausts the broker service's memory the next time BROKA reads it. The service stops and is restarted — the recipe, the chart and the package all restart it — and while the batch is still read, it can stop again. Nothing is disclosed and nothing else is changed; Kafka, Redis, RabbitMQ, Artemis and Memcached operations are unavailable while the service is down.
Why the other three do not
Typed Snappy arrays — CVE-2026-93451
The overflow is in snappy-java's methods that decompress straight into an array of numbers. Kafka's client decompresses through snappy-java's streams only, and nothing else in the broker service image calls those methods.
Guava deserialization — CVE-2026-102554
The allocation happens while Java deserialization rebuilds certain Guava collections. The broker service reads no Java-serialized data of its own, and since 1.0.0 it has installed a filter for the whole process that refuses to deserialize any class outside the Java platform's own, so a Guava collection is refused before it is built.
The Brotli decoder — CVE-2026-111497
The base image carries the Brotli library only for its font library. The broker service draws no text or images, so neither is ever loaded.
What to do
Upgrade to 1.3.3. Its broker service image runs snappy-java 1.1.10.9, Guava 33.7.2 and Brotli 1.2.0-3ubuntu0.1, which fix all four; an upgrade is new images and a restart, and the 1.3.3 release notes have the details. Until then, who can produce to the topics BROKA reads is what limits the one reachable finding: keep produce rights to the people and applications that need them.
Scanners that read OpenVEX can take this advisory's statements from the document linked on this page, which names each affected image by digest.
Timeline
- 2026-09-18: CVE-2026-93451 is published.
- 2026-10-09: CVE-2026-108106 and CVE-2026-102554 are published, with snappy-java 1.1.10.9 and Guava 33.7.2.
- 2026-10-22: CVE-2026-111497 is published.
- 2026-10-28 and 2026-10-29: the nightly scan of 1.3.2's published images reports them.
- 2026-11-02: 1.3.3 is released with this advisory.