Hi, The published apache/kafka Docker images still ship a vulnerable brotli-libs for CVE-2026-111497 (out-of-bounds write in the libbrotli decoder). Could the supported tags be rebuilt and re-pushed?
What I checked on 2026-10-30: 1. apache/kafka:3.9.0 - Alpine 3.20.3, brotli-libs 1.1.0-r2 2. apache/kafka:3.9.2 - Alpine 3.23.3, brotli-libs 1.2.0-r0 3. apache/kafka:4.1.2 - Alpine 3.23.3, brotli-libs 1.2.0-r0 4. apache/kafka:latest (4.4.0, pushed 2026-10-22) - Alpine 3.23.4, brotli-libs 1.2.0-r0 Alpine shipped the fix as brotli-libs 1.2.1-r0 on 2026-10-26, after the latest tag was built. brotli-libs is pulled in by freetype in the JRE base image, so Kafka itself doesn't use it, but scanners flag every apache/kafka tag. No code change should be needed. docker/jvm/Dockerfile already runs apk update and apk upgrade on top of eclipse-temurin:25-jre-alpine, so a rebuild of the supported tags picks up 1.2.1-r0. I tested a thin image FROM apache/kafka:3.9.2 with apk upgrade brotli-libs and it gets 1.2.1-r0. Separately, supported_image_tag in .github/workflows/docker_scan.yml lists 4.3.1 rather than 4.3.2 and doesn't include 4.4.0. Happy to send a PR for that if useful. Thanks, Matan Baruch
