{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://broka.dev/security/vex/BROKA-SA-2026-007.json",
  "author": "Orchesta Labs",
  "role": "Software vendor",
  "timestamp": "2026-11-02T00:00:00Z",
  "last_updated": "2026-11-02T00:00:00Z",
  "version": 1,
  "tooling": "broka-site scripts/build-docs.mjs",
  "statements": [
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-92392"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3A970d84988be550d17af596a4eb1105d2bffdf6608c7b9a6c73c689fc4786c34b?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad66b43fe284880c1d59d24e882b4f391e358bd52bc0b9a6e8a866ed03ba92041?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aa8e301bffcab66b1dd3e567169c7dd5c54d9bdc30add4e3d84dcc4067d84f077?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Af59c21921345c683cd05416e17da0618edeb11865be8c08ab81947c91f88ab6a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ad980ebd5c787cf16034aefe20189b72c75c3dd95f1aa809710e52ea409fe6fba?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A6b63822397b09a54a9faa2206a752376e3e13d473d04fc6122ffda9f315db73d?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Abe312eed32f7253d798313c8b066e5f9428f500b98212e0363f260a214cf4c27?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Ab6e4e89fa981b16f9d14746faa2875ec9772ed6bed7e4282092be1ce5b830179?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3A33dca04650e959bad03b19d576e9ac948b497feaf3540a7757c28ae0b5dc5b03?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aec69b890ec00075482c347046c26a85441e0ae37051d37061dec83d4d3e5afef?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.0.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.1.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.2.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.0",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.1",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.2",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The use-after-free happens while curl uploads over HTTP/2. Nothing in the console image runs curl: the health check uses busybox wget, the start scripts call neither, and nginx does not link curl's library."
    },
    {
      "timestamp": "2026-11-02T00:00:00Z",
      "vulnerability": {
        "name": "CVE-2026-92392"
      },
      "products": [
        {
          "@id": "pkg:oci/broka-ui@sha256%3Aadb8dea1c5224ae9d8beb3fe0d71f6d56e76baa7864d712ec181374f2172aa5a?repository_url=index.docker.io%2Forchestalabs%2Fbroka-ui&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.23.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.23.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        },
        {
          "@id": "pkg:oci/broka-ui-commercial?repository_url=registry.broka.dev%2Fbroka-ui-commercial&tag=1.3.3",
          "subcomponents": [
            {
              "@id": "pkg:apk/alpine/curl@8.23.0-r0?arch=x86_64&distro=3.24.2"
            },
            {
              "@id": "pkg:apk/alpine/libcurl@8.23.0-r0?arch=x86_64&distro=3.24.2"
            }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}