{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-006.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-11-02T00:00:00Z",
  "last_updated": "2026-11-02T00:00:00Z",
  "version": 1,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-108106"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A5068d38b320a0259536ea0e7bcff7d36aa45408c88a01c85362ccc8f5ba95155?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Af49360ceb704f64bbc68d5dad0652329e3e680dc49e7bf9ee599ea337198898d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A93967ee2b468d370a07624c6461ce454a0b8b8034810bb0a255b86e94084c134?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A79806da77699faa843729aa6463a512e49407223ad4af8da9ae4bec9fdf60436?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        }
      ],
      "status": "affected",
      "action_statement": "Upgrade to 1.3.3, whose broker service image carries snappy-java 1.1.10.9. Until then, limit produce rights on the topics BROKA reads to the people and applications that need them: a crafted Snappy batch on such a topic can exhaust the broker service's memory when BROKA reads it — browsing, searching or working out a consumer group's lag in time — and the service stops until it is restarted."
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-93451"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A5068d38b320a0259536ea0e7bcff7d36aa45408c88a01c85362ccc8f5ba95155?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Af49360ceb704f64bbc68d5dad0652329e3e680dc49e7bf9ee599ea337198898d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A93967ee2b468d370a07624c6461ce454a0b8b8034810bb0a255b86e94084c134?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A79806da77699faa843729aa6463a512e49407223ad4af8da9ae4bec9fdf60436?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.7"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The overflow is in snappy-java's typed Snappy.uncompress*Array methods. Kafka's client decompresses through SnappyInputStream only, and nothing else in the broker service image calls those methods."
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-102554"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A5068d38b320a0259536ea0e7bcff7d36aa45408c88a01c85362ccc8f5ba95155?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Af49360ceb704f64bbc68d5dad0652329e3e680dc49e7bf9ee599ea337198898d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A93967ee2b468d370a07624c6461ce454a0b8b8034810bb0a255b86e94084c134?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A79806da77699faa843729aa6463a512e49407223ad4af8da9ae4bec9fdf60436?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@32.1.3-jre"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "inline_mitigations_already_exist",
      "impact_statement": "The allocation happens during Java deserialization of Guava's CompactHashMap, CompactHashSet or MapMakerInternalMap. The broker service reads no Java-serialized data of its own, and its process-wide deserialization filter, installed in every release from 1.0.0, admits only java.* and javax.management.* classes, so no Guava class is ever deserialized."
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-111497"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A64a58107ddee79cc6520d8aa1ff14ebca5a3064a1db702273e69b4195132d0aa?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Ac6cc6ba65eb0bc462452ad75967c9c0db23e2b6549077fdf05d2cdcd2630b2de?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A204ecc717d6ed61a868f819a058289d3c93851633d65b01077864016a7c65967?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Acfa54f58a57f469930f930c2ebcf818a7a89764e992e4550521cef1ad31fe9ac?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A020080a64c98775dfd6126c9dbdf5ac048f346fe93fdc13d5e80194ea0605df6?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A2a807946dccc0e125b300c1150ceae030b9e0956bc4778d25471b1957705821a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A5068d38b320a0259536ea0e7bcff7d36aa45408c88a01c85362ccc8f5ba95155?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3Af49360ceb704f64bbc68d5dad0652329e3e680dc49e7bf9ee599ea337198898d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A93967ee2b468d370a07624c6461ce454a0b8b8034810bb0a255b86e94084c134?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker@sha256%3A79806da77699faa843729aa6463a512e49407223ad4af8da9ae4bec9fdf60436?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3build1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The out-of-bounds write is in the Brotli decoder. In the broker service image libbrotli1 is there only for the base image's font library, libfreetype6, and the broker service draws no text or images, so neither is loaded."
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-108106"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A13b589ccdc3c170ca9107c2c73b4fb4e37f4eaaa65f5b0093bab74725d6db59a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.9"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.9"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-93451"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A13b589ccdc3c170ca9107c2c73b4fb4e37f4eaaa65f5b0093bab74725d6db59a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.9"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:maven/org.xerial.snappy/snappy-java@1.1.10.9"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-102554"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A13b589ccdc3c170ca9107c2c73b4fb4e37f4eaaa65f5b0093bab74725d6db59a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@33.7.2-jre"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:maven/com.google.guava/guava@33.7.2-jre"
            }
          ]
        }
      ],
      "status": "fixed"
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-111497"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-broker@sha256%3A13b589ccdc3c170ca9107c2c73b4fb4e37f4eaaa65f5b0093bab74725d6db59a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-broker&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3ubuntu0.1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-broker-commercial?repository_url=registry.broka.dev%2Fbroka-broker-commercial&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:deb/ubuntu/libbrotli1@1.2.0-3ubuntu0.1?arch=amd64&distro=ubuntu-26.04"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}