Microsoft and others patch critical HTTP2Shell flaw in Brotli compression
Multiple technology companies have released patches for a critical remote code execution flaw found in the Brotli compression algorithm.
Vulnerability details and impact
The bug is an out-of-bounds write flaw tracked as CVE-2026-111497. It carries a severity score of 9.2 out of 10 according to security databases. The issue could allow attackers to execute remote code on affected systems.
Affected software and libraries
The vulnerability impacts Node.js, Python packages, and .NET applications that use the library. Administrators are urged to update their systems immediately to prevent potential attacks. No confirmed exploitation has been reported in the wild yet.
Vendor response and fixes
Microsoft and other vendors have scrambled to push out security patches for the issue. The fix addresses memory corruption risks associated with the compression algorithm. Users should apply updates as soon as they become available.
Reported by one outlet
Only one outlet has published this. Nothing here has been checked against a second report, so read it as that outlet's account and follow the link below for the original.
Reported by
1 independent outlet. Headline as published. Links open the original report.