{"document":{"category":"csaf_vex","csaf_version":"2.1","notes":[{"category":"summary","text":"Palo Alto Networks PSIRT provided VEX document. This document is autogenerated.","title":"Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products"}],"publisher":{"category":"vendor","name":"Palo Alto Networks","namespace":"https://security.paloaltonetworks.com"},"title":"Palo Alto Networks PSIRT provided VEX document: CVE-2026-111497","distribution":{"text":"Copyright © 2024 Palo Alto Networks. All rights reserved.","tlp":{"label":"CLEAR","url":"https://www.first.org/tlp/"}},"tracking":{"current_release_date":"2026-10-27T01:14:00.378Z","generator":{"date":"2026-10-27T01:14:00.378Z","engine":{"name":"Vulnogram","version":"0.1.0-dev"}},"id":"CVE-2026-111497","initial_release_date":"2026-10-26T18:30:00.000Z","revision_history":[{"number":"1","date":"2026-10-26T11:30:00.000Z","summary":"Initial Publication."},{"number":"2","date":"2026-10-26T11:45:00.000Z","summary":"Change font in product status table"},{"number":"3","date":"2026-10-26T16:40:00.000Z","summary":"Updated FAQ; renamed Venafi products; added conditions for threat ID"}],"status":"final","version":"1"}},"product_tree":{"branches":[{"name":"Palo Alto Networks","category":"vendor","branches":[{"name":"Prisma Cloud - Application Security Transporter Client","category":"product_name","branches":[{"category":"product_version_range","name":"vers:generic/Prisma Cloud - Application Security Transporter Client<0.2.9","product":{"name":"Palo Alto Networks Prisma Cloud - Application Security Transporter Client","product_id":"PANW-Prisma-Cloud---Application-Security-Transporter-Client-1"}},{"category":"product_version_range","name":"vers:generic/Prisma Cloud - Application Security Transporter Client>=0.2.9","product":{"name":"Palo Alto Networks Prisma Cloud - Application Security Transporter Client","product_id":"PANW-Prisma-Cloud---Application-Security-Transporter-Client-1"}}]},{"name":"PAN-OS","category":"product_name","branches":[{"category":"product_version_range","name":"vers:generic/PAN-OS<12.2.4-h1","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-946"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.2.4-h1","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-946"}},{"category":"product_version_range","name":"vers:generic/PAN-OS<12.1.4-h13","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-947"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.1.10-h3","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-948"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.1.7-h11","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-949"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=12.1.4-h13","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-947"}},{"category":"product_version_range","name":"vers:generic/PAN-OS<11.2.4-h23","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-950"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.16-h1","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-951"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.13-h4","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-952"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.10-h17","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-953"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.7-h23","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-954"}},{"category":"product_version_range","name":"vers:generic/PAN-OS>=11.2.4-h23","product":{"name":"Palo Alto Networks PAN-OS","product_id":"PANW-PAN-OS-950"}}]},{"name":"PAN-OS 11.1","category":"product_name","branches":[{"category":"product_version","name":"PAN-OS 11.1 All","product":{"name":"Palo Alto Networks PAN-OS 11.1","product_id":"PANW-PAN-OS-11.1-1"}}]},{"name":"PAN-OS 10.2","category":"product_name","branches":[{"category":"product_version","name":"PAN-OS 10.2 All","product":{"name":"Palo Alto Networks PAN-OS 10.2","product_id":"PANW-PAN-OS-10.2-1"}}]}]}]},"vulnerabilities":[{"cve":"CVE-2026-111497","product_status":{"fixed":["PANW-Prisma-Cloud---Application-Security-Transporter-Client-1","PANW-PAN-OS-946","PANW-PAN-OS-948","PANW-PAN-OS-949","PANW-PAN-OS-947","PANW-PAN-OS-951","PANW-PAN-OS-952","PANW-PAN-OS-953","PANW-PAN-OS-954","PANW-PAN-OS-950"],"known_affected":["PANW-Prisma-Cloud---Application-Security-Transporter-Client-1","PANW-PAN-OS-946","PANW-PAN-OS-947","PANW-PAN-OS-950"],"known_not_affected":["PANW-PAN-OS-11.1-1","PANW-PAN-OS-10.2-1"]},"notes":[{"category":"description","text":"Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497.\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.\n\nPalo Alto Networks is actively investigating its product portfolio and cloud services to determine potential impact from this vulnerability. The sections below will be updated as our analysis progresses and additional information or remediation status becomes available."}],"references":[{"category":"external","summary":"NVD - CVE-2026-111497","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111497"},{"category":"self","summary":"Palo Alto Networks Security Advisory CVE-2026-111497","url":"https://security.paloaltonetworks.com/CVE-2026-111497"}],"threats":[{"category":"impact","description":"Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497.\n\nA buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.\n\nPalo Alto Networks is actively investigating its product portfolio and cloud services to determine potential impact from this vulnerability. The sections below will be updated as our analysis progresses and additional information or remediation status becomes available."}],"scores":[{"cvss_v4":{"version":"4.0","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"HIGH","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"USER","valueDensity":"DIFFUSE","vulnerabilityResponseEffort":"MODERATE","providerUrgency":"AMBER","exploitMaturity":"NOT_DEFINED","baseSeverity":"CRITICAL","baseScore":9.2,"threatSeverity":"CRITICAL","threatScore":9.2,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:N/R:U/V:D/RE:M/U:Amber"},"products":["PANW-Prisma-Cloud---Application-Security-Transporter-Client-1","PANW-PAN-OS-946","PANW-PAN-OS-947","PANW-PAN-OS-950"]}]}]}