Palo Alto Networks’ October 26 advisory puts a critical Brotli decoder flaw on the traffic-inspection path of some PA-Series and VM-Series firewalls. An affected PAN-OS build is exposed when Brotli inspection and TLS/SSL decryption are both enabled on the dataplane. The vendor now lists some PAN-OS 11.2, 12.1 and 12.2 hotfix thresholds without ETAs, while others still have estimates. Check whether the matching build is downloadable; until it is installed, disable Brotli inspection and verify that it is off.
The firewall decompresses traffic while inspecting it. A crafted Brotli stream can corrupt decoder memory, potentially disclosing memory, causing denial of service or enabling code execution. Palo Alto Networks rates the vulnerability 9.2 critical but suggests moderate urgency and says it is unaware of malicious exploitation. Palo Alto Networks excludes the management web and API interfaces: “There is no impact on the Management interface (web or API) of the PAN-OS devices.”
A compressed stream reaches inspection
Google’s CVE record identifies an out-of-bounds write in the Brotli decoder’s c/dec/decode.c. Google credits Khai Tran and Sylvie Mayer of OpenAI Codex Security with finding the flaw. In the Node.js project’s account, the decoder mistakes an invalid block switch for an incomplete stream. It keeps feeding bytes into an eight-byte internal buffer until the write runs past its end. That is the upstream flaw tracked as CVE-2026-111497; Palo Alto Networks’ advisory maps it to its own products and configurations.
Inspection of Brotli traffic is unsupported before PAN-OS 11.2.4 and disabled by default in 11.2.4 and later. Dataplane TLS/SSL decryption must also be enabled for the PAN-OS exposure Palo Alto Networks describes. PAN-OS 11.1 and 10.2, Panorama and Idira self-hosted products are listed as unaffected. Prisma Cloud Application Security Transporter Client is a separate affected product: update affected client versions below 0.2.9 to 0.2.9 or later; its exposure requires no special configuration.
PAN-OS fixes are scheduled
Palo Alto Networks lists these first unaffected PAN-OS hotfix builds, with availability still expressed as an ETA in its October 26 advisory:
| PAN-OS line | Listed first unaffected builds | Advisory ETA |
|---|---|---|
12.2 | 12.2.4-h1 | October 28 |
12.1 | 12.1.4-h13, 12.1.7-h11, 12.1.10-h3 | October 29, 28 and 30 respectively |
11.2 | 11.2.4-h23, 11.2.7-h23, 11.2.10-h17, 11.2.13-h4, 11.2.16-h1 | October 30, 29, 27, 27 and 28 respectively |
Keep the installed maintenance line beside that table: a hotfix threshold from another line is the wrong comparison. As of the October 27 advisory, 12.2.4-h1, 12.1.7-h11 and 11.2.10-h17 no longer carry ETAs in the vendor’s status table; the table alone does not confirm that each package can be downloaded. Palo Alto Networks says it is directly managing Brotli fixes for the cloud services it lists as remediated, including ADEM, Cloud Identity Engine and Prisma AIRS Gateway; customers of those listed SaaS services have no rollout to perform. Palo Alto Networks is still evaluating other products and cloud services.
Check the dataplane setting now
On PAN-OS 11.2.4 or later, run show system setting brotli on each firewall in the affected branches and record the installed build and whether dataplane TLS/SSL decryption is enabled. Enabled: yes identifies active Brotli inspection; the vendor also accepts show system setting brotli-encoding returning Enabled: Yes. In PAN-OS 12.1.2 or later, the web setting is Device > Setup > Content-ID > Content-ID Settings > Allow Brotli Encoding. This setting check scopes exposure; it is not a compromise indicator.
While a matching hotfix is pending, Palo Alto Networks recommends set system setting brotli-encoding disable to turn off Brotli inspection globally, or unchecking Allow Brotli Encoding in the web interface and committing the configuration. Run show system setting brotli again and confirm Enabled: no. For customers with Threat Prevention, Threat ID 97686 in Applications and Threats content 9165 or later offers partial coverage; it is an additional layer rather than the full workaround. When the scheduled build becomes available, check Palo Alto Networks’ updated table, install the matching hotfix and record the live build alongside the Brotli and decryption settings.
An affected build with both inspection settings on needs a setting change while its hotfix is pending; a recorded Enabled: no confirms the documented workaround took effect.