Repository navigation
[Enhancement](docker) Rebuild release images for Broccoli2Shell (CVE-2026-111497); publish -slim again; move base to Ubuntu 26.04 LTS #70229
Description
Urgent: Broccoli2Shell (CVE-2026-111497)
CVE-2026-111497 ("Broccoli2Shell") is an out-of-bounds write in the Brotli decoder that can lead to remote code execution. CVSS 9.8, EPSS ~83 %, and it is being exploited.
Every current release image is affected. Checked on apache/doris:fe-4.1.5:
$ docker run --rm --entrypoint sh apache/doris:fe-4.1.5 -c 'dpkg-query -W libbrotli1'
libbrotli1 1.0.9-2build6 # Ubuntu 22.04.5; fixed in 1.0.9-2ubuntu0.1
The package comes in through libcurl4, so it is in every image built on apache/doris:base-6.0 / Dockerfile_base_slim. A fix only needs a rebuild of the base (apt-get upgrade) and of the release images.
Ask 1 (urgent): rebuild and re-push the supported release tags (*-4.1.5, *-4.1.4.1, *-4.0.8) on a patched base.
Smaller images
Dockerfile_base_slim (#60458) is a good start, but -slim tags stopped at 4.1.0. The full images are ~4 GB and ship debug tooling (gdb, bpfcc, kernel headers, python2-dev…) that most production users never run, and that grows the CVE surface.
Ask 2: publish -slim for every release, and consider making it the default.
Base OS
Both bases are FROM ubuntu:22.04, whose standard support ends in April 2027.
Ask 3: move the base to the current LTS, Ubuntu 26.04, or 24.04 at minimum, and keep to LTS releases only.
If it helps, I can open the PRs: Dockerfile_base / Dockerfile_base_slim on Ubuntu 26.04 LTS, and the release workflow publishing -slim for each version. Happy to test candidate images too.
Activity
SLoeuillet commentedon Nov 4, 2026
One more point for slim-by-default: the debug tooling (
gdb,perf/pprof,iperf3,tcpdump,bpfcc-tools,strace…) doesn't need to be in the runtime image. On Kubernetes ≥ 1.25,kubectl debug -it <pod> --image=<tools-image> --target=<container> --profile=sysadminattaches it as an ephemeral container that shares the Doris process namespace, sogdb -p/perf topwork unchanged.apache/doris:debug-latestcould become that tools image. The production image then only needs glibc, the JDK,mysql-client,iproute2,net-tools,curl,jq,ca-certificatesandtzdata, which is whatDockerfile_base_slimalready has.