CVE-2026-111497: Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products

Published Oct 21, 2026
·
Updated

Summary

Out-of-bounds Write vulnerability in the bundled Brotli decoder in yjh0502 erl-brotli allows an attacker who supplies a crafted Brotli-compressed stream to brotli:decode/1 to corrupt decoder state memory, disclose memory contents, crash the Erlang VM, or potentially execute code.

erl-brotli compiles its own copy of the Google Brotli C sources under csrc into a NIF, and brotlidecoderdecompressstream in csrc/brotlinif.c hands the input to BrotliDecoderDecompressStream. In csrc/dec/decode.c, DecodeBlockTypeAndLength returns false for a block switch in a category with at most one block type, and the non-streaming callers DecodeLiteralBlockSwitch, DecodeCommandBlockSwitch and DecodeDistanceBlockSwitch discard that result, so decoding continues with inconsistent state. The decoder runs inside a NIF, so memory corruption or a crash takes down the whole VM rather than the calling process. Because the package carries its own copy of the library, the Brotli version installed on the host does not matter.

This issue affects brotli: from 0.3.0 before 0.3.4.

Impact

An attacker who can get an application to decode a Brotli stream they control, for example an HTTP client that decompresses Content-Encoding: br responses with this package, can crash the Erlang VM and potentially run code inside it.

Other sources

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.

— Ubuntu

A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution. This vulnerability affects Node.js 22.x, 24.x, and 26.x.

— OSV

A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.

An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.

This vulnerability affects Node.js 26.x, 24.x, and 22.x.

— Node.Js

A flaw in the Brotli decoder bundled with Node.js allows malformed compressed input to write past the end of an internal decoder buffer.

An invalid block switch was reported as a temporary need for more input instead of a permanent format error, so the streaming decoder kept appending input bytes to an eight-byte internal buffer. An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory, which can lead to a crash, disclosure of process memory, or remote code execution.

— Node.Js

AirPlay. A logic issue was addressed with improved state management.

— Apple

Credit

CVE-2026-111497, Apple, an anonymous researcher, László Várady

Affected Software

220 affected componentsFixes available
Google Brotli>=1.0.3<=1.2.0
Node.js Node.js>=22.0.0<22.23.4
22.23.4
Node.js Node.js>=24.0.0<24.22.1
24.22.1
Node.js Node.js>=26.0.0<26.12.1
26.12.1
Node.js Node.js>=22.0.0<22.23.4, >=24.0.0<24.22.1, >=26.0.0<26.12.1
22.23.424.22.126.12.1
All of the following
azurelinux/nodejs<24.22.1-1
24.22.1-1
Microsoft Azure Linux=3.0
Microsoft PowerShell>=7.6<7.6.9
7.6.9
All of the following
azurelinux/brotli<1.2.1-1
1.2.1-1
Microsoft Azure Linux=3.0
Microsoft Visual Studio 2022>=17.14<17.14.43
17.14.43
Microsoft Visual Studio 2026>=18.11<18.11.2
18.11.2
All of the following
Microsoft .NET>=10.0<10.0.403
10.0.403
Apple macOS*
Microsoft Visual Studio 2019>=16.11<16.11.61
16.11.61
Microsoft PowerShell>=7.4<7.4.22
7.4.22
All of the following
Microsoft .NET>=11.0<11.0.100-rc.3.26522.148
11.0.100-rc.3.26522.148
Apple macOS*
Microsoft PowerShell>=7.5<7.5.13
7.5.13
All of the following
Microsoft .NET>=9.0<9.0.320
9.0.320
Apple macOS*
All of the following
Microsoft .NET>=9.0<9.0.320
9.0.320
Linux Linux*
All of the following
Microsoft .NET>=11.0<11.0.100-rc.3.26522.148
11.0.100-rc.3.26522.148
Microsoft Windows*
All of the following
Microsoft .NET>=10.0<10.0.403
10.0.403
Microsoft Windows*
All of the following
Microsoft .NET>=8.0<8.0.427
8.0.427
Linux Linux*
All of the following
Microsoft .NET>=9.0<9.0.320
9.0.320
Microsoft Windows*
All of the following
Microsoft .NET>=8.0<8.0.427
8.0.427
Apple macOS*
All of the following
Microsoft .NET>=8.0<8.0.427
8.0.427
Microsoft Windows*
All of the following
Microsoft .NET>=11.0<11.0.100-rc.3.26522.148
11.0.100-rc.3.26522.148
Linux Linux*
Microsoft Visual Studio 2026<18.12
18.12
All of the following
Microsoft .NET>=10.0<10.0.403
10.0.403
Linux Linux*
Microsoft Visual Studio 2017=15.9
Google Brotli
ubuntu/brotli<1.0.3-1ubuntu1~16.04.2+esm1
1.0.3-1ubuntu1~16.04.2+esm1
ubuntu/brotli<1.0.3-1ubuntu1.3+esm1
1.0.3-1ubuntu1.3+esm1
ubuntu/brotli<1.0.7-6ubuntu0.1+esm1
1.0.7-6ubuntu0.1+esm1
ubuntu/nodejs*
ubuntu/brotli<1.0.9-2ubuntu0.1
1.0.9-2ubuntu0.1
ubuntu/dotnet6*
ubuntu/dotnet8<8.0.133-8.0.33-0ubuntu1~22.04.1
8.0.133-8.0.33-0ubuntu1~22.04.1
ubuntu/brotli<1.1.0-2ubuntu0.1
1.1.0-2ubuntu0.1
ubuntu/dotnet10<10.0.114-10.0.14-0ubuntu1~24.04.1
10.0.114-10.0.14-0ubuntu1~24.04.1
ubuntu/dotnet8<8.0.133-8.0.33-0ubuntu1~24.04.1
8.0.133-8.0.33-0ubuntu1~24.04.1
ubuntu/brotli<1.2.0-4ubuntu0.1
1.2.0-4ubuntu0.1
ubuntu/dotnet10<10.0.114-10.0.14-0ubuntu1~26.10.1
10.0.114-10.0.14-0ubuntu1~26.10.1
ubuntu/dotnet11<11.0.100-11.0.0~rc3-0ubuntu1~26.10.1
11.0.100-11.0.0~rc3-0ubuntu1~26.10.1
ubuntu/brotli<1.2.0-3ubuntu0.1
1.2.0-3ubuntu0.1
ubuntu/dotnet10<10.0.114-10.0.14-0ubuntu1~26.04.1
10.0.114-10.0.14-0ubuntu1~26.04.1
All of the following
azurelinux/qemu=10.1.0-1
Microsoft Azure Linux=3.0
Microsoft Visual Studio 2017>=15.9<15.9.84
15.9.84
All of the following
azurelinux/p7zip=16.02-23
Microsoft Azure Linux=3.0
All of the following
azurelinux/qemu=10.1.0-2
Microsoft Azure Linux=3.0
alpine/brotli>=1.0.3<1.1.1-r0
1.1.1-r0
alpine/brotli>=1.0.3<1.2.1-r0
1.2.1-r0
alpine/brotli>=1.0.3<1.2.1-r0
1.2.1-r0
alpine/nodejs-current<26.12.1-r0
26.12.1-r0
pip/brotlicffi>=1.0.3<1.2.1.0
1.2.1.0
pip/brotli>=1.0.3<1.2.1
1.2.1
bitnami/dotnet>=8.0.0<8.0.33
8.0.33
bitnami/dotnet>=9.0.0<9.0.22
9.0.22
bitnami/dotnet>=10.0.0<10.0.14
10.0.14
bitnami/dotnet-sdk>=8.0.0<8.0.33
8.0.33
bitnami/dotnet-sdk>=9.0.0<9.0.22
9.0.22
bitnami/dotnet-sdk>=10.0.0<10.0.14
10.0.14
bitnami/node<22.23.4
22.23.4
bitnami/node>=23.0.0<24.22.1
24.22.1
bitnami/node>=26.0.0<26.12.1
26.12.1
bitnami/node-min<22.23.4
22.23.4
bitnami/node-min>=23.0.0<24.22.1
24.22.1
bitnami/node-min>=26.0.0<26.12.1
26.12.1
pip/brotli<1.2.1
1.2.1
bitnami/brotli>=1.0.3<1.0.10
1.0.10
bitnami/brotli>=1.1.0<1.1.1
1.1.1
bitnami/brotli>=1.2.0<1.2.1
1.2.1
bitnami/powershell>=7.4.0<7.4.22
7.4.22
bitnami/powershell>=7.5.0<7.5.13
7.5.13
bitnami/powershell>=7.6.0<7.6.9
7.6.9
erlang/brotli>=0.3.0<0.3.4
0.3.4
go/github.com/andybalholm/brotli<1.2.7
1.2.7
pip/brotlicffi<1.2.1.0
1.2.1.0
Apple iOS<27.2.1
27.2.1
Apple iPadOS<27.2.1
27.2.1
Apple macOS Golden Gate<27.2.1
27.2.1
Palo Alto Networks Prisma Cloud - Application Security Transporter Client<0.2.9, =
0.2.9
Palo Alto Networks PAN-OS<12.2.4-h1, =12.2, <12.1.4-h13, =12.1, <11.2.4-h23, =11.2
12.2.4-h112.1.10-h312.1.7-h1112.1.4-h1311.2.16-h111.2.13-h411.2.10-h1711.2.7-h2311.2.4-h23
Palo Alto Networks PAN-OS 11.1
Palo Alto Networks PAN-OS 10.2
debian/brotli<=1.0.9-2, <=1.1.0-2
1.0.9-2+deb12u11.1.0-2+deb13u11.2.0-4.1
debian/edk2<=2022.11-6+deb12u2, <=2022.11-6+deb12u1, <=2025.02-8+deb13u1
2026.08+ds-3
debian/nodejs<=18.20.4+dfsg-1~deb12u2, <=18.20.4+dfsg-1~deb12u3, <=20.19.2+dfsg-1+deb13u2, <=20.19.2+dfsg-1+deb13u3
24.22.2+dfsg+~cs24.19.2-1
debian/python-brotlicffi<=1.1.0.0+ds1-1
1.2.1.0+ds-1
Google Brotli>=1.0.3<1.0.10
Google Brotli>=1.1.0<1.1.1
Google Brotli>=1.2.0<1.2.1
Nodejs Node.js<22.23.4
Nodejs Node.js>=23.0.0<24.22.1
Nodejs Node.js>=25.0.0<26.12.1
Python-hyper Brotlicffi Python<1.2.1.0
Microsoft .NET>=8.0.0<8.0.33
Microsoft .NET>=9.0.0<9.0.22
Microsoft .NET>=10.0.0<10.0.14
Microsoft .NET=11.0.0-preview1
Microsoft .NET=11.0.0-preview2
Microsoft .NET=11.0.0-preview3
Microsoft .NET=11.0.0-preview4
Microsoft .NET=11.0.0-preview5
Microsoft .NET=11.0.0-preview6
Microsoft .NET=11.0.0-preview7
Microsoft .NET=11.0.0-rc1
Microsoft .NET=11.0.0-rc2
Debian Debian Linux=12.0
Istio Istio<1.29.9
Istio Istio>=1.30.0<1.30.6
Istio Istio>=1.31.0<1.31.2
Anthropic Bun<1.4.4
Envoyproxy Envoy<1.37.8
Envoyproxy Envoy>=1.38.0<1.38.6
Envoyproxy Envoy>=1.39.0<1.39.3
Tianocore edk2<=202608
Google Woff2
DuckDB DuckDB<=2.0.0
Clickhouse Clickhouse<=26.10.2.103
Apache Arrow<=26.0.0
Apache Arrow=27.0.0-dev
Mcmilk 7-zip-zstd<=26.02-1.5.7-r2
7-Zip p7zip<=16.02
andybalholm Brotli Go<1.2.7
All of the following
Siemens Ruggedcom Ape1808 Firmware
Siemens Ruggedcom Ape1808
Siemens Common Configurator
Siemens Data Flow Monitoring
Siemens Edge Opc Ua Server Configurator
Siemens Flow Creator Configurator
Siemens Industrial Edge Cloud Connector Configurator
Siemens Industrial Edge Databus Configurator
Siemens Industrial Edge Hub
Siemens Industrial Edge Management Cloud
Apple macOS Tahoe<26.7.3
26.7.3
Apple macOS Sequoia<15.8.3
15.8.3
Apple iOS<26.7.3
26.7.3
Apple iPadOS<26.7.3
26.7.3
Apple WatchOS<27.2.1
27.2.1
Apple visionOS<27.2.1
27.2.1
Siemens Data Flow Monitoring<3.0.18
Siemens Dataxess Configurator<1.5.7
Siemens Edge Opc Ua Server Configurator<2.3.10
Siemens Flow Creator Configurator<1.15.1
Siemens Industrial Edge Cloud Connector Configurator<1.24.3
Siemens Industrial Edge Databus Configurator<4.0.1
Siemens Comos Walkinside
Siemens Simatic Braumat=8.2-update1
Siemens Simatic Braumat=8.2-update2
Siemens Simatic Braumat=8.2-update3
Siemens Simatic Braumat=8.2-update4
Siemens Simatic Braumat=8.2-update5
Siemens Simatic Profiling Tool
Siemens Simatic Sistar=8.2-update1
Siemens Simatic Sistar=8.2-update2
Siemens Simatic Sistar=8.2-update3
Siemens Simatic Sistar=8.2-update4
Siemens Simatic Sistar=8.2-update5
Siemens SIMATIC WinCC>=7.0<=8.2
Siemens Simatic Wincc Companion
Siemens SIMATIC WinCC Runtime
Siemens Simatic Wincc Unified For Industrial Edge
Siemens SIMATIC WinCC Unified PC Runtime
Siemens Simatic Wincc Unified Siqence
Siemens Tia Administrator
Siemens Tia Project-server Web Administration Tool
Siemens User Management Component
Siemens Hyperlynx
Siemens Innexis Architecture Native Acceleration
Siemens Insights Hub
Siemens Opcenter Connect Electronics
Siemens Opcenter Connect Manufacturing Operations Management
Siemens Opcenter Execution Core
Siemens Opcenter Execution Discrete
Siemens Opcenter Execution Foundation
Siemens Opcenter Execution Pharma
Siemens Opcenter Execution Process
Siemens Opcenter Intelligence
Siemens Opcenter Quality
Siemens Opcenter Rd\&l
Siemens Opcenter X
Siemens Pads Professional
Siemens Pads Professional
Siemens Pave360 Automotive=2026
Siemens Process Preparation X
Siemens Simcenter Executable Digital Twin
Siemens Simcenter Studio
Siemens Teamcenter=2412.0
Siemens Teamcenter=2506.0
Siemens Teamcenter=2512.0
Siemens Teamcenter=2606.0
Siemens Xpedition Designer
Siemens Xpedition Enterprise
debian/brotli<1.0.9-2+deb12u1
1.0.9-2+deb12u1
debian/brotli<1.1.0-2+deb13u1
1.1.0-2+deb13u1
debian/brotli<1.2.0-4.1
1.2.0-4.1
debian/edk2*
debian/edk2*
debian/edk2<2026.08+ds-3
2026.08+ds-3
debian/nodejs*
debian/nodejs*
debian/nodejs<24.22.1+dfsg+~cs24.19.2-1
24.22.1+dfsg+~cs24.19.2-1
debian/python-brotlicffi*
debian/python-brotlicffi<1.2.1.0+ds-1
1.2.1.0+ds-1
Microsoft Visual Studio 2017=15.9, >=1416/1.0.0<1416/1.0.0.2026202302
1416/1.0.0.2026202302

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 22.23.4
  2. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 24.22.1
  3. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26.12.1
  4. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 22.23.4Fixed in 24.22.1Fixed in 26.12.1
  5. Upgrade

    Upgrade azurelinux/nodejs to a version that resolves this vulnerability.

    Fixed in 24.22.1-1
  6. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 7.6.9
  7. Upgrade

    Upgrade azurelinux/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.1-1
  8. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 17.14.43
  9. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.11.2
  10. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 10.0.403Patch KB5133966
  11. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 16.11.61
  12. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 7.4.22
  13. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 11.0.100-rc.3.26522.148
  14. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 7.5.13
  15. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 9.0.320Patch KB5133965
  16. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 8.0.427Patch KB5133964
  17. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 18.12
  18. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.3-1ubuntu1~16.04.2+esm1
  19. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.3-1ubuntu1.3+esm1
  20. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.7-6ubuntu0.1+esm1
  21. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.9-2ubuntu0.1
  22. Upgrade

    Upgrade ubuntu/dotnet8 to a version that resolves this vulnerability.

    Fixed in 8.0.133-8.0.33-0ubuntu1~22.04.1
  23. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.1.0-2ubuntu0.1
  24. Upgrade

    Upgrade ubuntu/dotnet10 to a version that resolves this vulnerability.

    Fixed in 10.0.114-10.0.14-0ubuntu1~24.04.1
  25. Upgrade

    Upgrade ubuntu/dotnet8 to a version that resolves this vulnerability.

    Fixed in 8.0.133-8.0.33-0ubuntu1~24.04.1
  26. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.0-4ubuntu0.1
  27. Upgrade

    Upgrade ubuntu/dotnet10 to a version that resolves this vulnerability.

    Fixed in 10.0.114-10.0.14-0ubuntu1~26.10.1
  28. Upgrade

    Upgrade ubuntu/dotnet11 to a version that resolves this vulnerability.

    Fixed in 11.0.100-11.0.0~rc3-0ubuntu1~26.10.1
  29. Upgrade

    Upgrade ubuntu/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.0-3ubuntu0.1
  30. Upgrade

    Upgrade ubuntu/dotnet10 to a version that resolves this vulnerability.

    Fixed in 10.0.114-10.0.14-0ubuntu1~26.04.1
  31. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.9.84
  32. Upgrade

    Upgrade alpine/brotli to a version that resolves this vulnerability.

    Fixed in 1.1.1-r0
  33. Upgrade

    Upgrade alpine/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.1-r0
  34. Upgrade

    Upgrade alpine/nodejs-current to a version that resolves this vulnerability.

    Fixed in 26.12.1-r0
  35. Upgrade

    Upgrade pip/brotlicffi to a version that resolves this vulnerability.

    Fixed in 1.2.1.0
  36. Upgrade

    Upgrade pip/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.1
  37. Upgrade

    Upgrade bitnami/dotnet to a version that resolves this vulnerability.

    Fixed in 8.0.33
  38. Upgrade

    Upgrade bitnami/dotnet to a version that resolves this vulnerability.

    Fixed in 9.0.22
  39. Upgrade

    Upgrade bitnami/dotnet to a version that resolves this vulnerability.

    Fixed in 10.0.14
  40. Upgrade

    Upgrade bitnami/dotnet-sdk to a version that resolves this vulnerability.

    Fixed in 8.0.33
  41. Upgrade

    Upgrade bitnami/dotnet-sdk to a version that resolves this vulnerability.

    Fixed in 9.0.22
  42. Upgrade

    Upgrade bitnami/dotnet-sdk to a version that resolves this vulnerability.

    Fixed in 10.0.14
  43. Upgrade

    Upgrade bitnami/node to a version that resolves this vulnerability.

    Fixed in 22.23.4
  44. Upgrade

    Upgrade bitnami/node to a version that resolves this vulnerability.

    Fixed in 24.22.1
  45. Upgrade

    Upgrade bitnami/node to a version that resolves this vulnerability.

    Fixed in 26.12.1
  46. Upgrade

    Upgrade bitnami/node-min to a version that resolves this vulnerability.

    Fixed in 22.23.4
  47. Upgrade

    Upgrade bitnami/node-min to a version that resolves this vulnerability.

    Fixed in 24.22.1
  48. Upgrade

    Upgrade bitnami/node-min to a version that resolves this vulnerability.

    Fixed in 26.12.1
  49. Upgrade

    Upgrade bitnami/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.10
  50. Upgrade

    Upgrade bitnami/brotli to a version that resolves this vulnerability.

    Fixed in 1.1.1
  51. Upgrade

    Upgrade bitnami/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.1
  52. Upgrade

    Upgrade bitnami/powershell to a version that resolves this vulnerability.

    Fixed in 7.4.22
  53. Upgrade

    Upgrade bitnami/powershell to a version that resolves this vulnerability.

    Fixed in 7.5.13
  54. Upgrade

    Upgrade bitnami/powershell to a version that resolves this vulnerability.

    Fixed in 7.6.9
  55. Upgrade

    Upgrade erlang/brotli to a version that resolves this vulnerability.

    Fixed in 0.3.4
  56. Upgrade

    Upgrade go/github.com/andybalholm/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.7
  57. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 27.2.1
  58. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 0.2.9
  59. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 12.2.4-h1Fixed in 12.1.10-h3Fixed in 12.1.7-h11Fixed in 12.1.4-h13Fixed in 11.2.16-h1Fixed in 11.2.13-h4Fixed in 11.2.10-h17Fixed in 11.2.7-h23Fixed in 11.2.4-h23
  60. Upgrade

    Upgrade debian/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.9-2+deb12u1Fixed in 1.1.0-2+deb13u1Fixed in 1.2.0-4.1
  61. Upgrade

    Upgrade debian/edk2 to a version that resolves this vulnerability.

    Fixed in 2026.08+ds-3
  62. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 24.22.2+dfsg+~cs24.19.2-1
  63. Upgrade

    Upgrade debian/python-brotlicffi to a version that resolves this vulnerability.

    Fixed in 1.2.1.0+ds-1
  64. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 26.7.3
  65. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 15.8.3
  66. Upgrade

    Upgrade debian/brotli to a version that resolves this vulnerability.

    Fixed in 1.0.9-2+deb12u1
  67. Upgrade

    Upgrade debian/brotli to a version that resolves this vulnerability.

    Fixed in 1.1.0-2+deb13u1
  68. Upgrade

    Upgrade debian/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.0-4.1
  69. Upgrade

    Upgrade debian/nodejs to a version that resolves this vulnerability.

    Fixed in 24.22.1+dfsg+~cs24.19.2-1
  70. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 1416/1.0.0.2026202302
  71. Upgrade

    Upgrade google/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.1
  72. Upgrade

    Upgrade github.com/andybalholm/brotli to a version that resolves this vulnerability.

    Fixed in 1.2.7
  73. Upgrade

    Upgrade yjh0502/erl-brotli to a version that resolves this vulnerability.

    Fixed in 0.3.4
  74. Upgrade

    Upgrade Prisma Cloud - Application Security Transporter Client to a version that resolves this vulnerability.

    Fixed in 0.2.9
  75. Upgrade

    Upgrade PAN-OS to a version that resolves this vulnerability.

    Fixed in 11.2.16
  76. Upgrade

    Upgrade PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.1.10
  77. Upgrade

    Upgrade PAN-OS to a version that resolves this vulnerability.

    Fixed in 12.2.4-h1
  78. Configuration

    Disable Brotli inspection globally with `set system setting brotli-encoding disable`, or in the Web Interface uncheck the Allow Brotli Encoding option under Device > Setup > Content-ID. Verify with `show system setting brotli` and confirm `Enabled: no`.

    PAN-OS Brotli inspection/decompression brotli-encoding = disable

Event History

Oct 21, 2026
CVE Published
via Node.js·10:39 AM
Data Sourced
via Node.js·10:39 AM
SeverityAffected Software
Exploit Published
via GitHub·03:47 PM
Data Sourced
via Node.js·10:00 PM
Description
Oct 22, 2026
CVE Published
via MITRE·01:35 PM
Data Sourced
via MITRE·01:35 PM
RemedyDescriptionWeakness
Data Sourced
via OSV·01:35 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·01:43 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·02:17 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:32 PM
Data Sourced
via GitHub·03:32 PM
DescriptionSeverityWeaknessAffected Software
Oct 23, 2026
Data Sourced
via Ubuntu·12:00 AM
RemedyDescriptionSeverityAffected Software
Oct 25, 2026
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Oct 26, 2026
News Published
via The Register·05:58 PM
Advisory Published
via Palo Alto Networks·06:30 PM
Data Sourced
via Palo Alto Networks·06:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Oct 27, 2026
Data Sourced
via CISA·12:00 AM
RemedyDescriptionWeaknessAffected Software
Nov 9, 2026
Data Sourced
via Apple·12:00 AM
DescriptionWeaknessAffected Software
Advisory Published
via Palo Alto Networks·09:00 PM

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

Which deployments are exposed to this issue?

Any deployment on any platform that uses a Google Brotli library or binary version from 1.0.3 through 1.2.0 is affected. The issue is in the Brotli decoder, so exposure depends on processing Brotli-compressed streams.

2

What does an attacker need to exploit the vulnerability?

An attacker can be remote and unauthenticated, but needs to supply a crafted Brotli-compressed stream to a vulnerable decoder. Successful exploitation may corrupt adjacent decoder state memory, disclose memory, cause denial of service, or potentially execute arbitrary code.

3

What versions should be deployed to remediate the issue?

Update affected Brotli libraries or binaries to the latest available version identified as 1.0.10, 1.1.1, or 1.2.1. Versions in the 1.0.3 through 1.2.0 range should be treated as needing an update.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203