// Google CloudCRITICAL
HTTP2Shell (CVE-2026-111497), a critical memory-corruption vulnerability in Google's Brotli compression library, was disclosed October 2026 with CVSS 9.2 score. The flaw in Brotli's decompression code can trigger out-of-bounds memory writes when processing malformed compressed input, potentially leading to arbitrary code execution. Affects Node.js, Python HTTP clients, Bun, Envoy, and Istio deployments. Patched versions released October 2026.
- HTTP2Shell Flaw: Critical Brotli Vulnerability Explained(opens in a new tab)
- Broccoli2shell: Everything You Need To Know About The Critical B(opens in a new tab)
- Microsoft releases emergency .NET security fixes for Google Brot(opens in a new tab)
- Cloudflare Adds New WAF Rules to Detect Attacks Targeting CVE-20(opens in a new tab)
- Palo Alto Confirms Brotli Vulnerability Impact on PAN-OS and Rel(opens in a new tab)
- Brotli2Shell: Google Brotli decoder (CVE-2026-111497) | Tenable®(opens in a new tab)
// Get alerts for Google Cloud