Official images (5.1.5, 4.2.8) still ship libbrotli1 1.1.0-2+b7 (CVE-2026-111497): rebuild planned?

[ashutosh-dwivedi-kaseya]

Hi, thanks for maintaining Fluent Bit.

The official fluent/fluent-bit images contain libbrotli1 1.1.0-2+b7, which is affected by CVE-2026-111497 (out-of-bounds write in the Brotli decoder). Debian has a fixed package, 1.1.0-2+deb13u1, in trixie-security:
https://security-tracker.debian.org/tracker/CVE-2026-111497

The images appear to predate that fix, so I'm not reporting a build defect. I'd just like to understand the plan.

Questions

1. Will the official images be rebuilt on an updated Debian 13 base, and is there an expected timeframe?
2. Would that be a rebuild of existing tags (5.1.5, 4.2.8), or only with the next patch release?

What I checked (2026-10-28)

• fluent/fluent-bit:5.1.5 — sha256:2740f387f6e68fab66d28e4fa6a853387b9cab6ffb4cb78958f69bba4eb0e7b4
• fluent/fluent-bit:4.2.8 — sha256:6806769c10acf11b41d14083b3101a24433b4ca113a1ab7a6b1a1b7cad86a7e8

Both report the same version. No scanner is needed, since the image is distroless and the package record can be read directly:

CID=$(docker create fluent/fluent-bit:5.1.5)
docker export $CID | tar -xO var/lib/dpkg/status.d/libbrotli1 | grep -E '^(Package|Version)'
docker rm $CID

Package: libbrotli1
Version: 1.1.0-2+b7

In a debian:trixie container, apt-cache policy libbrotli1 offers 1.1.0-2+deb13u1 as the candidate.

The fluent-bit binary links libcurl.so.4, which links libbrotlidec, so the library is loaded. I'm not claiming the issue is exploitable in Fluent Bit, only that scanners flag it.

A scanner reports the same on a related image: fluent/fluent-operator#2082

Environment: amd64, Debian 13 (distroless), Kubernetes DaemonSet.

Thanks!