Sweet Virtual Patching Stops HTTP2Shell Vulnerability
Original title: Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
Sweet Virtual Patching protects Node.js and other runtimes from HTTP2Shell until permanent Brotli fixes are released.
HTTP2Shell (CVE-2026-111497) is a critical remote code execution flaw in Brotli compression used by Node.js, Bun, Envoy, Python and more. AI discovered it during a red-teaming campaign. Exploitation attempts occurred in 88 percent of monitored environments after disclosure. Sweet Virtual Patching uses eBPF to block the exploit path at runtime by stopping process creation in the vulnerable decoder without code changes.
- Root-cause fix sat unrecognized for eight months
- Brotli appears in multiple libraries requiring separate patches
- Sweet blocks the clone system call in the exploit path
- Virtual patching available with 30 days free coverage
- Organizations should identify exposed Brotli services first
Impact: unauthenticated remote code execution
- 1.Apply Sweet Virtual Patching to block Brotli exploitation
- 2.Identify running services using Brotli decompression
- 3.Monitor for suspicious decompression attempts
- CVEs
- CVE-2026-111497
- Vendors
- Sweet
- Products
- Brotli
- Organizations
- OpenAI
- AI models
- OpenAI agents
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
4 min read at helpnetsecurity.com
HTTP2Shell (CVE-2026-111497), the critical Brotli bug first known as Node2Shell, is a remote code execution flaw in the compression library inside Node. js, Bun, Envoy, Python and more. AI found it: OpenAI’s agents turned it up in late September during a high-compute red-teaming campaign.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.