Palo Alto Networks Security Advisories / CVE-2026-111497

CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products

Urgency MODERATE

047910
Severity 9.2 · CRITICAL
Exploit Maturity N/A
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements PRESENT
Automatable NO
User Interaction NONE
Product Confidentiality HIGH
Product Integrity HIGH
Product Availability HIGH
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE
CVE JSON CSAF
Published 2026-10-26
Updated 2026-10-26
Discovered externally

Description

Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.

Palo Alto Networks is actively investigating its product portfolio and cloud services to determine potential impact from this vulnerability. The sections below will be updated as our analysis progresses and additional information or remediation status becomes available.

Product Status

VersionsAffectedUnaffected
PAN-OS 12.2< 12.2.4-h1
>= 12.2.4-h1 (ETA: 10/28)
PAN-OS 12.1< 12.1.4-h13
< 12.1.7-h11
< 12.1.10-h3
>= 12.1.4-h13 (ETA: 10/29)
>= 12.1.7-h11 (ETA: 10/28)
>= 12.1.10-h3 (ETA: 10/30)
PAN-OS 11.2< 11.2.4-h23
< 11.2.7-h23
< 11.2.10-h17
< 11.2.13-h4
< 11.2.16-h1
>= 11.2.4-h23 (ETA: 10/30)
>= 11.2.7-h23 (ETA: 10/29)
>= 11.2.10-h17 (ETA: 10/27)
>= 11.2.13-h4 (ETA: 10/27)
>= 11.2.16-h1 (ETA: 10/28)
PAN-OS 11.1None
All
PAN-OS 10.2None
All
Prisma Cloud - Application Security Transporter Client < 0.2.9
>= 0.2.9

*Brotli encoding is disabled by default in PAN-OS 11.2.4 and later, and is unsupported in PAN-OS 11.2.3 and earlier.

Cloud & SaaS Products (No Action Required)

For the SaaS products listed below, Palo Alto Networks is directly managing the backend rollout of Brotli fixes. No customer action is necessary.

Additional cloud products will be added to this list as evaluations and remediations are completed.

Remediated:

Required Configuration for Exposure

PAN-OS

This issue is applicable to PAN-OS software on PA-Series and VM-Series firewalls that have inspection of Brotli compressed traffic and TLS/SSL decryption enabled on the dataplane. There is no impact on the Management interface (web or API) of the PAN-OS devices.

Brotli inspection is not supported for PAN-OS versions before 11.2.4.

To check if you have this configuration is enabled follow below steps:

On the CLI (PAN-OS 11.2.4 or higher):

  1. Log in to the firewall command-line interface.
  2. Run the command show system setting brotli.
  3. Check the output. The firewall is only exposed if the output displays Enabled: yes (or if show system setting brotli-encoding returns Enabled: Yes).
On the Web Interface (PAN-OS 12.1.2 and later):

  1. Navigate to Device > Setup > Content-ID.
  2. Locate the Content-ID Settings pane.
  3. Check if the Allow Brotli Encoding option is checked.

Other Products

No special configuration is required to be affected by this issue.

Severity: CRITICAL, Suggested Urgency: MODERATE

Vendor
CRITICAL - CVSS-BT: 9.2 /CVSS-B: 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Weakness Type and Impact

CWE-787 Out-of-bounds Write

CAPEC-100 Overflow Buffers

Solution

PAN-OS

This issue will be fixed in the upcoming releases of PAN-OS. Refer Product Status table for details.

Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.

Prisma Cloud - Application Security Transporter Client

Upgrade to the fixed version listed in Product Status Table

Workarounds and Mitigations

PAN-OS

Customers can mitigate the risk of this issue by taking any of the following actions:

Disable Brotli Inspection via the CLI (PAN-OS 11.2.4 or higher):

  1. You can disable the Brotli inspection engine globally on the firewall by running the following command in the command-line interface: set system setting brotli-encoding disable.
  2. To verify that decompression has been disabled, execute show system setting brotli and confirm the output displays Enabled: no.
Disable Brotli Decompression via the Web Interface (PAN-OS 12.1.2 and later):
  1. Navigate to Device > Setup > Content-ID.
  2. Locate the Content-ID settings pane and click the edit icon.
  3. Uncheck the Allow Brotli Encoding option.
  4. Commit the configuration changes.
Customers with a Threat Prevention subscription are provided with partial coverage against this vulnerability by enabling Threat ID 97686 (from Applications and Threats content version 9165 and later). For this Threat ID to protect against attacks for this vulnerability:

Frequently Asked Questions

Q. Is Panorama impacted?

Panorama (virtual and M-series) is not impacted.

Q. Is there any impact on PAN-OS 11.1 and 10.2 versions?

PAN-OS 11.1 and 10.2 versions are not impacted.

Q. Does CVE-2026-111497 apply to Idira self-hosted products?

No. Idira self-hosted products are not affected by this CVE.

Q. Where can I find more information regarding how Idira is affected by CVE-2026-111497?

More information is available in the Knowledge Base article on the CyberArk Community page: https://community.cyberark.com/s/article/Node-js-Brotli-decoder-out-of-bounds-write-CVE-2026-111497-High

Q. Along with the PHP vulnerability, now there is a vulnerability in the brotli compression library used by Node.js. Will I need to do two updates?

No, the same hotfix covers both the PHP and brotli vulnerabilities. The only exception is 11.2.10-h16 which only includes the fix for PHP vulnerabilities; 11.2.10-h17 includes fixes for both vulnerabilities.

CPE Applicability

Timeline

Updated FAQ; renamed Venafi products; added conditions for threat ID
Change font in product status table
Initial Publication.
Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure PolicyReport vulnerabilitiesManage subscriptions
© 2026 Palo Alto Networks, Inc. All rights reserved.