Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Original title: Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
The offer covers non-customers for 30 days; Sweet reports attempts in 88% of monitored environments.
A CyberNewswire release says Sweet Security is extending runtime virtual patching for HTTP2Shell (CVE-2026-111497) through Sweet Safety Net at no cost for 30 days. The flaw is described as sitting in the Brotli decoder in Node.js, Bun, Python, Envoy, Istio and Go frameworks such as Traefik, Fiber and Iris. Sweet says it is already seeing exploitation attempts and that updating every bundled decoder will take weeks. Fixed versions are not named.
Unconfirmed: Active exploitation is Sweet’s account of attempts in its monitored environments, not an independent confirmation.
- CVE-2026-111497 is the identifier given for HTTP2Shell.
- The release also refers to blocking exploitation of Node2Shell.
- Customers can apply a policy from Sweet’s Vulnerabilities Catalog.
- No purchase commitment is required to claim the 30-day sensors.
Impact: Exploitation of the built-in Brotli decoder code path
| Product | Affected |
|---|---|
| Node.js | — |
| Bun | — |
| Python | — |
| Envoy | — |
| Istio | — |
| Traefik | — |
| Fiber | — |
| Iris | — |
- 1.Claim the 30-day Sweet Safety Net sensors while engineering ships a permanent fix.
- CVEs
- CVE-2026-111497
- Vendors
- Sweet Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at gbhackers.com
New York, NY, October 27th, 2026, CyberNewswire The root-cause fix will take weeks; protection can’t wait Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497). The capability will enable users to block any exploitation of Node2Shell at no cost for 30 days, whether or […]
By CyberNewswire · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.