{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-005.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-10-24T00:00:00Z",
  "last_updated": "2026-10-24T00:00:00Z",
  "version": 1,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-15176"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The overflow needs a location that combines alias with a rewrite, set or return directive referencing $request_filename, or $request_filename in an access log format. BROKA's nginx configuration has no alias directive and never references $request_filename, in a location or in either log format."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-93479"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The overflow needs a map's regex capture variable to be referenced by a root directive or an access log format before the map's own variable is used. BROKA's one regex map with a capture ($edge_proto, in the map that sets $forwarded_proto) uses the capture only as that map's value; its root is a fixed path and neither log format names the capture."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-97205"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.5-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The use-after-free needs asynchronous file I/O (aio) together with Server Side Includes (ssi) serving an include virtual. BROKA's nginx configuration and the base image's enable neither aio nor ssi."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-111497"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.0-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The out-of-bounds write is in the Brotli decoder. In the console image brotli-libs is there only for curl's library and for freetype and fontconfig, which serve nginx's image-filter module through libgd. BROKA's nginx configuration loads no dynamic module, nginx itself does not link Brotli, and nothing in the image runs curl: the health check uses busybox wget."
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-15176"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aec69b890ec00075482c347046c26a85441e0ae37051d37061dec83d4d3e5afef?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.6-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.6-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-93479"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aec69b890ec00075482c347046c26a85441e0ae37051d37061dec83d4d3e5afef?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.6-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.6-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-97205"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aec69b890ec00075482c347046c26a85441e0ae37051d37061dec83d4d3e5afef?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.6-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/nginx@1.30.6-r1?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-10-24T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-111497"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aec69b890ec00075482c347046c26a85441e0ae37051d37061dec83d4d3e5afef?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/brotli-libs@1.2.1-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}