Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

CVE v události 10

Hodnocení z katalogů, všechna, se stupnicí CVSS a vydavatelem. Rozpad vektoru je na stránce CVE. Advisory v textu uvádí CVSS 9.8.

Jak se o tom psalo 16

1. 27. 10. 2026 · zachyceno 04:30 · NCSC-FI FI

   CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products

   Classification: Critical, Solution: Workaround, Exploit Maturity: Not Defined, CVSSv3.1: 9.2, CVEs: CVE-2026-111497, Summary: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to…

2. 27. 10. 2026 · zachyceno 04:30 · NCSC-FI FI

   Fortinet: Multiple Node.js CVEs being investigated

   Classification: Critical, Solution: Unavailable, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-111497, CVE-2026-105481, CVE-2026-106072, CVE-2026-106074, CVE-2026-106070, CVE-2026-106071, CVE-2026-106073, Summary: Fortinet is currently investigating the impact of these CVEs over Fortinet Products. Products under investigation: FortiOS Products confirmed NOT impacted: FortiManager FortiAnalyzer FortiClient EMS FortiAuthenticator…

3. 27. 10. 2026 · zachyceno 04:30 · NCSC-FI FI

   Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder

   Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.1, CVEs: CVE-2026-111497, Summary: Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. Tracked as CVE-2026-111497, this critical-severity flaw stems from an out-of-bounds write in the Brotli decoder, which expands data compressed using Google's widely used Brotli lossless compression algorithm. To address…

4. 27. 10. 2026 02:19 · Tenable Research US

   Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)

   Researchers have demonstrated remote code execution through CVE-2026-111497, an out-of-bounds write in Google's Brotli decoder library, and public proofs-of-concept (PoCs) are available. Software that uses the decoder includes Node.js,.NET, Bun, Envoy Proxy, Istio, Python HTTP clients and PHP for Windows. Key Takeaways CVE-2026-111497, known as Brotli2Shell and by several other names, is an out-of-bounds write in Google's Brotli decoder library that Google, the CVE Numbering Authority (CNA),…

5. 26. 10. 2026 19:45 · Palo Alto PSIRT US

   CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)

6. 26. 10. 2026 17:27 · BleepingComputer US nadpis události

   Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches

   A critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data. [...]

7. 26. 10. 2026 16:38 · BleepingComputer US

   Microsoft releases emergency .NET patches for critical Brotli flaw

   Microsoft released emergency .NET security updates to patch a critical vulnerability known as Broccoli2Shell, also tracked as Node2Shell and HTTP2Shell. [...]

8. 26. 10. 2026 15:07 · Cyber Centre Kanada CA

   Google security advisory (AV26-1085)

   Serial number: AV26-1085 Date: October 26, 2026 As of October 22, 2026, Google is affected by a vulnerability in the following product: Brotli Versions 1.0.3 to versions prior to v1.0.10 Versions 1.1.0 to versions prior to v1.1.1 Versions 1.2.0 to versions prior to v1.2.1 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Brotli Releases

9. 26. 10. 2026 14:10 · CSIRT Itálie (ACN) IT

   Google: disponibile PoC per lo sfruttamento della CVE-2026-111497

   Disponibile un Proof of Concept (PoC) per lo sfruttamento della CVE-2026-111497, presente nel decoder di Google Brotli, libreria open source ampiamente impiegata per la compressione e decompressione dei contenuti web e incorporata in numerosi prodotti e framework software, tra cui Node.js, DuckDB, Apache Arrow, .NET e diverse librerie Python.

10. 26. 10. 2026 13:18 · CSIRT.CZ (CZ.NIC) CZ

    Kritická zranitelnost Broccoli2Shell ohrožuje aplikace využívající HTTP

    V kompresní knihovně Brotli byla objevena kritická zranitelnost Broccoli2Shell (CVE-2026-111497, CVSS 9,2), která může útočníkovi umožnit vzdálené spuštění škodlivého kódu (RCE) bez nutnosti autentizace. Ke zneužití může stačit, aby zranitelná aplikace zpracovala speciálně upravená komprimovaná data připravená útočníkem. Zranitelnost je závažná zejména kvůli širokému využití algoritmu Brotli, který patří mezi standardně podporované kompresní algoritmy protokolu HTTP vedle gzip a zstd. Používají…

11. 26. 10. 2026 · zachyceno 18:00 · Fortinet PSIRT US

    Multiple Node.js CVEs

    CVSSv3 Score: 9.8 CVE-2026-105482 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105483 - (high)This vulnerability affects Node.js 26.x and 24.x.CVE-2026-106069 - (high)This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-111497 - (high)A flaw in Node.js can cause Node.js Brotli decoder out-of-bounds write permits remote code execution.This vulnerability affects Node.js 26.x, 24.x, and 22.x.CVE-2026-105481 - (medium)This vulnerability affects Node.js 26.x,…

12. 26. 10. 2026 · zachyceno 17:30 · CERT-FR – avis FR

    Vulnérabilité dans les produits Microsoft (26 octobre 2026)

    Une vulnérabilité a été découverte dans les produits Microsoft. Elle permet à un attaquant de provoquer une élévation de privilèges.

13. 23. 10. 2026 22:45 · Aikido Security BE

    Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497)

    The Brotli flaw behind Node2Shell (CVE-2026-111497) affects Python apps with Brotli or brotlicffi installed. Check your versions and upgrade to the fix. Category: Vulnerabilities & Threats

14. 23. 10. 2026 14:58 · Qualys US

    Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do

    Executive Summary On October 21, 2026, Node.js released fixes for 10 vulnerabilities across its three supported release lines: 22.x, 24.x, and 26.x. Four are rated High. The most severe, CVE-2026-111497, is an out-of-bounds write in the bundled Brotli decoder that Node.js says permits remote code execution. These flaws live in the Node.js runtime itself, not in application packages, so dependency checks will not surface them. Qualys customers can find affected runtimes across hosts, containers,…

15. 23. 10. 2026 11:55 · NCSC-NL NL

    NCSC-2026-0453 [1.00] [M/H] Kwetsbaarheid in Google Brotli-decoder

    Google heeft een kwetsbaarheid verholpen in de Brotli-decompressiebibliotheek. Deze bibliotheek wordt onder meer gebruikt in Node.js. Een ongeauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door speciaal vervaardigde Brotli-gecomprimeerde gegevens te laten verwerken. Succesvol misbruik kan leiden tot een denial-of-service, toegang tot gevoelige gegevens uit het procesgeheugen of het uitvoeren van willekeurige code met de rechten van het getroffen proces.

16. 22. 10. 2026 20:11 · Aikido Security BE

    Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497)

    Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats