CYBERSECURITYTRACKER
Permanent story citation

Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 12155

As cited

Copy frozen at (site build).

vulnerabilities

Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

CVE-2026-111497 (HTTP2Shell) is a critical remote code execution vulnerability in the Brotli compression library affecting Node.js, Bun, Envoy, Python, and other software. Artificial intelligence (AI) agents discovered the flaw during a red-teaming campaign in late September. Virtual patching solutions can mitigate the exposure while vendors release permanent fixes.

Why it matters: Organizations running Node.js, Bun, Envoy, Python, and related software with Brotli are vulnerable to remote code execution until vendors patch; virtual patching options exist for immediate defense.

CVEsCVE-2026-111497
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary