Critical ‘HTTP2Shell’ Brotli Vulnerability (CVE‑2026‑111497) Enables Remote Code Execution Across Multiple Platforms
What Happened — A buffer‑overflow flaw in the Brotli compression library (CVE‑2026‑111497), dubbed HTTP2Shell, allows an attacker to craft a Brotli‑compressed stream that overruns an internal eight‑byte buffer. The overflow can corrupt memory and lead to remote code execution (RCE). The bug exists in Brotli versions 1.0.3‑1.0.9, 1.1.0 and 1.2.0 and is leveraged by runtimes that embed the decoder, including Node.js, Microsoft .NET, and Python HTTP clients such as urllib3, requests, httpx and aiohttp. Microsoft issued an emergency .NET update on 26 Oct 2026; Node.js and Google released patches on 21‑23 Oct 2026.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of maintaining timely vulnerability remediation and patch management, a single control that maps to many frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected — SaaS providers, cloud‑infrastructure operators, and any software that relies on Brotli for HTTP compression (Node.js, .NET, Python ecosystems).
Recommended Actions
- Inventory all systems that use Brotli 1.0.3‑1.2.0 and upgrade to the patched releases (Brotli ≥ 1.0.10, 1.1.1, 1.2.1).
- Verify that downstream dependencies (e.g., urllib3‑brotli, requests‑brotli) are also updated.
- Enable continuous monitoring for vulnerable library versions in your software‑bill‑of‑materials (SBOM).
- Document the remediation steps as audit evidence for your control‑assurance program.
Technical Notes
- Attack vector: Maliciously crafted Brotli‑compressed data delivered via HTTP responses or direct server requests.
- CVE: CVE‑2026‑111497 (CVSS 9.8 Critical).
- Impact: Memory corruption → remote code execution.
- Affected components: Brotli decoder (versions 1.0.3‑1.0.9, 1.1.0, 1.2.0) in Node.js, .NET, Python HTTP libraries.
- Mitigations: Patches released by Google (Brotli 1.0.10, 1.1.1, 1.2.1), Node.js (v18.20.0+, v20.12.0+), Microsoft .NET (security update KB502xxxx).