Security Assessment of Brotli Compression Vulnerability (CVE-2026-111497) for Carbon Black Cloud

Products

• Carbon Black Cloud Workload
• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Whether Carbon Black Cloud products—including the Carbon Black Cloud Workload Appliance and Endpoint Sensors—are vulnerable to CVE-2026-111497, a vulnerability identified in the Google Brotli compression/decompression library.

CVE-2026-111497 involves a flaw in the Google Brotli compression/decompression library (often referred to in the context of Node.js or "HTTP2Shell" vulnerabilities). This vulnerability potentially allows for unauthorized operations through malicious decompression processes.

Resolution

Carbon Black Cloud products are Not Applicable / Not Impacted by CVE-2026-111497.

• Carbon Black Cloud Sensors (Windows, Linux, macOS): The endpoint sensors operate as native binaries and do not include, rely on, or utilize the vulnerable Brotli library for compression or decompression tasks.
• Carbon Black Cloud Workload Appliance: The architecture of the Workload appliance does not incorporate or leverage the vulnerable Brotli component.
• Carbon Black Cloud Backend Services: Cloud backend microservices do not utilize or expose the affected library in a way that would be susceptible to this CVE.

Because the vulnerable Brotli compression/decompression component is not present within the Carbon Black Cloud product architecture, the products are not affected by CVE-2026-111497.