VeloCloud Shows Why Integration Endpoint Trust Needs an Owner
Integration endpoint trust is the part of an orchestrator's exposure that an inbound-reachability review can miss. On November 2, 2026, Arista published Security Advisory 0202 for VeloCloud Orchestrator (VCO), the platform that configures, monitors and manages VeloCloud SD-WAN deployments, covering CVE-2026-111497, a memory-corruption flaw in the Brotli decoder. Arista's wording draws the line…
Arista published a security advisory on November 2, 2026, addressing a memory-corruption flaw in the Brotli decoder of its VeloCloud Orchestrator (VCO) platform. This flaw, CVE-2026-111497, can be exploited if the affected runtime processes a crafted Brotli response through an outbound HTTP client that automatically decompresses the response.
Arista stated that exploitation requires specific conditions to be met, and that VCO deployments are not inherently vulnerable. It is unclear if VCO has been exploited through this path, or if any specific integration paths have been compromised. Arista recommends upgrading to a fixed version to mitigate the risk. The advisory highlights the importance of owning and validating the validation boundary surrounding content returned by configured integration endpoints.
This is because the vulnerability exists at the decoder stage, and the decisions determining what reaches it occur upstream. The flaw lies in the four-step process of opening a connection to a configured integration endpoint, receiving a response, decompressing the response, and processing the bytes. The exposure assessment should consider the outbound steps, such as the destination, redirects, and the HTTP client's decompression behavior, rather than solely focusing on inbound reachability.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
