From 511366f22f1121fceef00239c4e1f97eb2c416a1 Mon Sep 17 00:00:00 2001 From: loks0n <22452787+loks0n@users.noreply.github.com> Date: Sat, 24 Oct 2026 11:52:14 +0100 Subject: [PATCH] fix: require brotli-libs 1.2.1 for CVE-2026-111497 The php:8.5-cli-alpine3.23 image already carries brotli-libs 1.2.0-r0 for curl, so the final stage's unversioned apk add was a no-op and 2.1.3 shipped the vulnerable decoder. A version floor in trusted-base forces the upgrade for every stage. Co-Authored-By: Claude Opus 5.5 --- Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 069cfae..a9c0c8f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,7 +5,10 @@ ARG ALPINE_VERSION=3.23 FROM php:${PHP_VERSION}-cli-alpine${ALPINE_VERSION} AS trusted-base # Distrust the compromised eMudhra chains before build-time or runtime HTTPS. -RUN apk add --no-cache 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0' && \ +# brotli-libs 1.2.1 fixes the decoder out-of-bounds write (CVE-2026-111497); +# the php image already carries 1.2.0 for curl, so the floor forces the upgrade. +RUN apk add --no-cache 'ca-certificates>=20261020-r0' 'ca-certificates-bundle>=20261020-r0' \ + 'brotli-libs>=1.2.1-r0' && \ update-ca-certificates FROM trusted-base AS compile