{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-001.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-10-11T00:00:00Z",
  "last_updated": "2026-10-11T00:00:00Z",
  "version": 1,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-106451"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.10.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "inline_mitigations_already_exist",
      "impact_statement": "The vulnerable code extracts lz4-java's native library to the temporary directory before loading it; exploiting it needs another local user who can write to that same directory first. In every way BROKA ships, the broker service has a temporary directory of its own and runs as its own non-root user: the container's private file system under Docker Compose, an emptyDir volume under the Helm chart, and PrivateTmp under the Linux package's systemd unit."
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-106451"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.11.4"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/at.yawk.lz4/lz4-java@1.11.4"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-78667"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The Go standard library is inside /usr/bin/pebble, a service manager the base image carries. Nothing in the broker image runs it: the image starts the Java service directly."
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-78667"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0"
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0"
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-78669"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The Go standard library is inside /usr/bin/pebble, a service manager the base image carries. Nothing in the broker image runs it: the image starts the Java service directly."
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-78669"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0"
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0"
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-97031"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.7"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The Go standard library is inside /usr/bin/pebble, a service manager the base image carries. Nothing in the broker image runs it: the image starts the Java service directly."
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-97031"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0"
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0"
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-4775"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "libtiff is in the image only as a dependency of nginx's image-filter module. The console's nginx never loads that module and never reads a TIFF file."
    },
    {
      "timestamp": "2026-10-11T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-4775"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.2-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/tiff@4.7.2-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}