Before PAN-OS 7.0, the Palo Alto Networks firewall was able to decode up to two levels of encoding. Files exceeding this level would be allowed to bypass file blocking. Since PAN-OS 7.0, the maximum level of decoding has been increased to 4.
Examples of encoding levels:
Word document (docx) in a zip file sent by email defines three levels of encoding
Word document (docx) zipped and sent through HTTP chunk encoding and gzip compression defines four levels of encoding
Up to and including PAN-OS 6.1.x, the way to prevent abuse of layers of encoding is to block the file types:
Starting from PAN-OS 7.0.x, these file types can be allowed to pass through while any files hidden in more levels of encoding can be blocked using Multi-Level-Encoding as a File Type in a File Blocking Profile: