@Rocky as a part of HTTP2Shell CVE-2026-111497 vulnerability, the Ubuntu images for Starrocks 4.0.13 run Ubuntu 22.04.5 with

libbrotli1

version 1.0.9-2build6. Ubuntu’s fixed version is 1.0.9-2ubuntu0.1 or later. How do you recommend we address this?

The HTTP2Shell (CVE-2026-111497) is a critical vulnerability affecting the Brotli decoder. For Ubuntu 22.04 (Jammy), which StarRocks 4.0.13 uses as its base, the fix was released in security advisory USN-8956-1 on October 26, 2026. To address this in your StarRocks environment, I recommend the following two approaches: 1. Immediate Workaround (Custom Image) If you cannot wait for the next StarRocks patch release, you can create a custom Docker image that upgrades

libbrotli1

to the fixed version (

1.0.9-2ubuntu0.1

or later). Create a `Dockerfile`:

dockerfile
FROM starrocks/fe-ubuntu:4.0.13 # Or be-ubuntu:4.0.13

# Switch to root to perform updates
USER root

# Update package list and specifically upgrade libbrotli1
RUN apt-get update && \
    apt-get install -y --only-upgrade libbrotli1 && \
    rm -rf /var/lib/apt/lists/*

# Switch back to the default StarRocks user if applicable
USER starrocks

Then build and use this image in your deployment. 2. Official StarRocks Update The StarRocks community typically refreshes Docker images for critical CVEs in the next patch version (e.g., 4.0.14) or by pushing updated tags for the current version to Docker Hub once the base image mirrors are updated. * Check Docker Hub: Verify the "Last Updated" timestamp for the

starrocks/fe-ubuntu:4.0.13

and

be-ubuntu:4.0.13

tags. If they have been updated recently (after Oct 26, 2026), pull the latest version of the tag. * Monitor Releases: Keep an eye on the official StarRocks GitHub Releases for version 4.0.14, which will include the OS-level security patches. Verification To confirm the fix is applied in a running container, you can run:

bash
docker exec -it <container_id> dpkg -l | grep libbrotli1

The version should be 1.0.9-2ubuntu0.1 or higher. For enterprise-grade support and specific timelines regarding security patches, I recommend contacting CelerData or checking the #security channel in the official StarRocks community Slack. References • developers/development-environment/dev-env-setup.md • developers/versions.md • introduction/versioning.md • quick_start/shared-nothing.md • developers/build-starrocks/Build_in_docker.md • faq/Deploy_faq.md

i'm not seeing any update in Docker Hub. Most of the 4.0.X images seem to be months old. The latest version 4.0.17 is a few days old, can you confirm if it has the fix?

you can rebuild the image from the corresponding artifact image with the dockerfile in codebase.