curl finding in the 1.0.0–1.3.2 console images
Image scanners report a high-severity CVE in curl 8.22.0 in the console image of 1.0.0 through 1.3.2. It needs curl to upload over HTTP/2, and nothing in the console image runs curl. 1.3.3 carries curl 8.23.0, which fixes it.
Not exploitable in any configuration BROKA ships
- Affected
- 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.1.2, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2
- Fixed in
- 1.3.3
- Editions
- Community and Commercial
- Severity
- High
- CVEs
- CVE-2026-92392
What was found
Image scanners report a high-severity vulnerability in curl 8.22.0, the command-line HTTP client the console image's base carries, in every version from 1.0.0 to 1.3.2:
| Component | Image | CVE | Upstream severity | In BROKA |
|---|---|---|---|---|
| curl 8.22.0 | Console | CVE-2026-92392 | High | never run |
Both editions are affected the same way: Community 1.0.0 through 1.3.2, and Commercial 1.0.1 through 1.3.2. The broker service and Orchestrator images do not carry curl.
Why it does not reach BROKA
The use-after-free happens while curl uploads over HTTP/2 and the server answers by resetting the stream. The console
image never runs curl: its health check uses the image's own wget, its start scripts call neither, and nginx, which
serves the console, does not use curl's library.
What to do
Upgrade to 1.3.3. Its console image carries curl 8.23.0; an upgrade is new images and a restart, and the 1.3.3 release notes have the details. No earlier version needs a workaround in the meantime.
Scanners that read OpenVEX can take this advisory's statements from the document linked on this page, which names each affected image by digest.
Timeline
- 2026-10-14: CVE-2026-92392 is published, with curl 8.23.0.
- 2026-10-26: the nightly scan of 1.3.2's published images reports it.
- 2026-11-02: 1.3.3 is released with this advisory.