Sweet offers free HTTP2Shell virtual patching amid claimed attacks
Original title: Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost
Sweet says exploitation attempts hit 88% of monitored environments and is giving any organization sensors for 30 days.
Sweet Security announced Sweet Safety Net, free runtime virtual patching for HTTP2Shell (CVE-2026-111497) for 30 days, including non-customers. The company says the flaw is in the Brotli decoder built into Node.js, Bun, Python, Envoy, Istio and Go frameworks including Traefik, Fiber and Iris. It reports active exploitation attempts and says a root-cause fix, requiring dependency updates and redeploys, will take weeks. No affected or fixed versions are stated.
Unconfirmed: Exploitation figures and blocking claims come only from Sweet Security and describe attempts, not confirmed compromises.
- The cited identifier is CVE-2026-111497; the notice also says Node2Shell.
- Sweet claims attempts across 88% of environments it monitors.
- Sensors apply a policy that blocks payloads without application code changes.
- Existing Sweet customers are described as already protected.
Impact: Exploitation of the built-in Brotli decoder code path
| Product | Affected |
|---|---|
| Node.js | — |
| Bun | — |
| Python | — |
| Envoy | — |
| Istio | — |
| Traefik | — |
| Fiber | — |
| Iris | — |
- 1.Claim Sweet Safety Net sensors for 30 days of virtual patching while permanent fixes are deployed.
- CVEs
- CVE-2026-111497
- Vendors
- Sweet Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
3 min read at cybersecuritynews.com
New York, NY, October 27th, 2026, CyberNewswire The root-cause fix will take weeks; protection can’t wait Sweet Security today announced Sweet Safety Net, extending its runtime Virtual Patching protection to every organization affected by HTTP2Shell (CVE-2026-111497). The capability will enable users to block any exploitation of Node2Shell at no cost for 30 days, whether or […]
By Cybernewswire · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.