Search threats, CVEs… ⌘K
Back to vendor advisories
Palo Alto Networks Security AdvisoriesCVE-2026-111497

CVE-2026-111497: Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products

CriticalVendor CVSS 9.2 / 10 1 CVE Published Oct 26, 2026 at 6:30 PM UTC
Get alerts for Prisma Cloud - Application Security Transporter Client

Summary

Palo Alto Networks is aware of the vulnerability in Brotli: CVE-2026-111497.

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. Brotli is commonly used by many HTTP-based applications including Node.js.

Palo Alto Networks is actively investigating its product portfolio and cloud services to determine potential impact from this vulnerability. The sections below will be updated as our analysis progresses and additional information or remediation status becomes available.

Products covered

  • Prisma Cloud - Application Security Transporter Client

  • PAN-OS

  • PAN-OS 11.1

  • PAN-OS 10.2

  • PAN-OS 12.2

  • PAN-OS 12.1

  • PAN-OS 11.2

Remediation

PAN-OS

This issue will be fixed in the upcoming releases of PAN-OS. Refer Product Status table for details.

Until PAN-OS fix versions are available we recommend implementing the workaround and mitigations listed below.

Prisma Cloud - Application Security Transporter Client

Upgrade to the fixed version listed in Product Status Table

Vendor-listed fixes

  • Prisma Cloud - Application Security Transporter Client >= 0.2.9

  • PAN-OS 12.2 >= 12.2.4-h1 (ETA: 10/28)

  • PAN-OS 12.1 >= 12.1.4-h13 (ETA: 10/29), >= 12.1.7-h11 (ETA: 10/28), >= 12.1.10-h3 (ETA: 10/30)

  • PAN-OS 11.2 >= 11.2.4-h23 (ETA: 10/30), >= 11.2.7-h23 (ETA: 10/29), >= 11.2.10-h17 (ETA: 10/27), >= 11.2.13-h4 (ETA: 10/27), >= 11.2.16-h1 (ETA: 10/28)

  • PAN-OS 11.1 All

  • PAN-OS 10.2 All

CVEs in this advisory 1

CVE-2026-111497

Updates

  1. Published by Palo Alto Networks

    The publication date reported by the vendor.

  2. Added to SecurityAlert

    We collected the advisory from the official source.

Keep investigating
See every advisory from this vendor