Manual interim workaround for CVE-2026-111497 (Brotli) on SDDC Manager 9.1.1.x

Products

• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

CVE-2026-111497 is a Critical severity vulnerability that impacts SDDC manager. This vulnerability and its impact on the mentioned VMware products are documented in the following VMware Security Advisory (VMSA), review this document before continuing:

• VMSA-2026-0008

Environment

• VCF 9.1.1.x
  • SDDC Manager 9.1.1 and 9.1.1 EP

Resolution

The workaround described in this document is meant to be a temporary solution only and is intended to ONLY mitigate CVE-2026-111497.

Step 1: Pre-requisites

1. Backup SDDC-M appliance.
2. SSH to the SDDC Manager as vcf user and then change to root.
3. Back up the two files which will be modified, use below commands to take the backup:
   
   APP=/opt/vmware/vcf/sddc-manager-ui-app/server/src/servers/sddcManagerServer/app.js

cp -p $APP $APP.orig-cve111497

cp -p /etc/nginx/nginx.conf /root/nginx.conf.before-cve111497

Step 2: nginx rule (covers the :443 path)

1. Edit the file /etc/nginx/nginx.conf.
2. Add the map in the http { } block.** Put it after the line "map_hash_bucket_size 128":
   
   

       # CVE-2026-111497 interim workaround: refuse request bodies that declare
       # Content-Encoding: br. Brotli is the only encoding affected by this CVE.
       # Remove once the Node.js runtime is upgraded to a fixed release.
       map $http_content_encoding $reject_br {
           default 0;
           "~*\bbr\b" 1;
       }

   
   Sample Result after the edit (Note: Command used less -N /etc/nginx/nginx.conf):
   
   

3. Add the check in the server { listen 443 ssl; ... } block.** Put it just before the # certs sent to the client in SERVER HELLO... comment, after the limit_req line:
   
   

           # CVE-2026-111497 interim workaround: reject Brotli request bodies
           # before they reach the UI server (localhost:7500). See map above.
           if ($reject_br) {
               return 415;
           }

   Sample result after the edit (Note: Command used less -N /etc/nginx/nginx.conf):

   
   
   
4. Test and reload by executing below command:
   
   

   nginx -t && systemctl reload nginx

   Sample result:
   

   
   
   1. If nginx -t fails, restore the configuration from the backup using below steps and contact Global Support:
      
      

      cp -p /root/nginx.conf.before-cve111497 /etc/nginx/nginx.conf
      nginx -t

 

Step 3: UI server check (covers the direct :7500 path)

nginx cannot see requests sent straight to 127.0.0.1:7500. This step closes that gap.

1. Edit $APP (/opt/vmware/vcf/sddc-manager-ui-app/server/src/servers/sddcManagerServer/app.js).
2. Find this line (around line 142):
   
   

   winston.debug('Mounting app middleware');

3. Add the block below it, before the app.use(bodyParser.json({... call:
   
   

      // CVE-2026-111497: reject Brotli request bodies before any parser runs.
      // Other encodings (gzip, deflate) are left as they are.
      app.use((req, res, next) => {
         if (/\bbr\b/i.test(req.headers['content-encoding'] || '')) {
            return res.status(415).json({ message: 'Brotli request bodies are not accepted', status: 415 });
         }
         next();
      });

   
   Sample result after the edit:
   
   
   
4. Restart the UI service
   
   

   systemctl restart sddc-manager-ui-app

5. Execute below script and Wait until it answers (it can take a minute):
   
   

   for i in $(seq 1 40); do
     c=$(curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:7500/ui/api/ping \
         -H 'Content-Type: application/json' --data-binary '{"a":1}')
     [ "$c" != 503 ] && [ "$c" != 000 ] && break
     sleep 6
   done
   echo "ui_code=$c"

Step 4: Verify

1. Run these on the SDDC Manager
   
   

   Test	Command	Expected after the fix
   Brotli body, direct to UI	curl -s -o /dev/null -w '%{http_code}' -X POST http://127.0.0.1:7500/ui/api/ping -H 'Content-Type: application/json' -H 'Content-Encoding: br' --data-binary '{"a":1}'	415
   Brotli body, through nginx	same command with -k https://127.0.0.1/ui/api/ping	415
   Plain JSON, through nginx	same command without Content-Encoding	not 415 (normal response, e.g. 401 or 403 if not logged in)
   gzip body	same command with -H 'Content-Encoding: gzip' and a gzip body	not 415

   
   Sample result:
   
2. Check the config is in place:
   
   

   nginx -T 2>/dev/null | grep -c reject_br        # expect 2 (map + if)
   grep -c 'CVE-2026-111497' $APP                   # expect 1

3. If a test returns something else, do not continue. Roll back (Step 5) and contact Global Support.

Step 5: Roll back

1. Execute the following commands to revert the files from the backup.
   
   

   cp -p $APP.orig-cve111497 $APP
   cp -p /root/nginx.conf.before-cve111497 /etc/nginx/nginx.conf
   nginx -t && systemctl reload nginx
   systemctl restart sddc-manager-ui-app