VulnRadar

Data against noise.

Built with NaN
Page generated: 06 Nov 2026, 03:48 UTC
← Dashboard

CVE-2026-111497

Log4Shell

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, …

Read full description
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVSS 9.2 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
8.2/10
REALITY · THREAT PRIORITY
8.8/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.2: +1.38
  • Fresh EPSS: 82.64%: +0.41

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 69 documents and public datasets.

Hype components

Headline sample (25%)
30/100
Press, 30 days (60%)
100/100
Grounded branding (15%)
100/100
HYPE TOTAL82/100

Sources and documents

Cisco Security Advisory
Technical advisory · 04 Nov 2026, 18:52 · Vulnerabilities in Node.js and Brotli Affecting Cisco Products: October 2026
Avisos INCIBE-CERT
Technical advisory · 04 Nov 2026, 08:25 · Escritura fuera de límites en productos de Citrix
Avisos INCIBE-CERT
Technical advisory · 04 Nov 2026, 08:25 · Múltiples vulnerabilidades en Dameware de SolarWinds
Help Net Security
Press · 03 Nov 2026, 06:00 · Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up
MSRC Security Update Guide
Technical advisory · 31 Oct 2026, 08:13 · CVE-2026-111497 Google: CVE-2026-111497 Buffer overflow vulnerability in the Brotli decoder
See all 69 source documents
Palo Alto Networks Security Advisories
Press · 31 Oct 2026, 03:15 · CVE-2026-111497 Portfolio Status: Impact of Brotli Vulnerability (CVE-2026-111497) on Palo Alto Networks Products (Severity: CRITICAL)
Cisco Security Advisory
Technical advisory · 30 Oct 2026, 19:55 · Vulnerabilities in Node.js Affecting Cisco Products: October 2026
Cisco Security Advisory
Press · 30 Oct 2026, 19:55 · Vulnerabilities in Node.js Affecting Cisco Products: October 2026
Pokde.Net
Press · 30 Oct 2026, 11:13 · HTTP2Shell Vulnerability in Google Brotli Library Puts Node.js and Other Software at Risk - Pokde.Net
Aikido Security
Press · 30 Oct 2026, 03:27 · What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained - Aikido Security
Ubuntu security notices
Technical advisory · 29 Oct 2026, 17:02 · USN-8958-1: .NET vulnerabilities
Avisos INCIBE-CERT
Press · 29 Oct 2026, 08:53 · Escritura fuera de límites en PHP para Windows
Avisos INCIBE-CERT
Press · 29 Oct 2026, 08:53 · Múltiples vulnerabilidades en OpenScape Endpoint Management de Mitel
Avisos INCIBE-CERT
Press · 29 Oct 2026, 08:53 · [Actualización 30/10/2026] Múltiples vulnerabilidades en productos de Cisco
Esri
Press · 29 Oct 2026, 07:00 · Brotli / Node.js Vulnerabilities - Esri
Check Point Blog
Press · 29 Oct 2026, 02:17 · HTTP2Shell: The Brotli Vulnerability That Extends Beyond Node.js - Check Point Blog
www.systemtek.co.uk
Press · 28 Oct 2026, 18:02 · Critical Brotli vulnerability exposes applications to remote code execution (CVE-2026-111497) - www.systemtek.co.uk
Security Boulevard
Press · 28 Oct 2026, 17:22 · CVE-2026-111497: Node2Shell / HTTP2Shell Vulnerability May Allow RCE - Security Boulevard
Sophos
Press · 28 Oct 2026, 16:25 · ‘Node2Shell’ vulnerability (CVE-2026-111497) in active exploitation - Sophos
Qualys
Press · 28 Oct 2026, 10:46 · Waiting on a Node.js Upgrade? Build a Stopgap with the Controls You Own - Qualys
BleepingComputer
Press · 28 Oct 2026, 10:46 · CISA warns of hackers now exploiting critical Node2Shell flaw - BleepingComputer
SOCRadar
Press · 28 Oct 2026, 10:34 · Node2Shell: Brotli Flaw Hits Python Packages - SOCRadar
Avisos INCIBE-CERT
Press · 28 Oct 2026, 09:06 · Escritura fuera de límites en SDDC Manager de Broadcom
The Hacker News
Press · 28 Oct 2026, 05:42 · Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
The Hacker News
Press · 28 Oct 2026, 05:42 · Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges - The Hacker News
Hong Kong Computer Emergency Response Team Coordination Centre
Press · 28 Oct 2026, 03:04 · Google Brotli Remote Code Execution Vulnerability - Hong Kong Computer Emergency Response Team Coordination Centre
Hacker News
Press · 27 Oct 2026, 23:41 · Broccoli2Shell: The One Decoder We All Depend On
Hackread
Press · 27 Oct 2026, 20:53 · Sweet Security Offers All Organizations Affected by HTTP2Shell Virtual Patching Protection at No Cost - Hackread
CyberSecurityNews
Press · 27 Oct 2026, 20:50 · HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow - CyberSecurityNews
TechRadar
Press · 27 Oct 2026, 18:45 · Microsoft and others scramble to patch 'HTTP2Shell' flaw which could be the next PHP-level issue — Node.js problem may also affect millions of sites - TechRadar
Help Net Security
Press · 27 Oct 2026, 17:38 · Brotli bug reaches far beyond Node.js (CVE-2026-111497) - Help Net Security
Forbes
Press · 27 Oct 2026, 13:39 · Microsoft Issues Emergency Patch For Critical Google Algorithm Flaw - Forbes
CISO Series
Press · 27 Oct 2026, 10:00 · Cybersecurity News: HTTP2Shell emergency updates, PHP2Shell attacks, GitHub worm - CISO Series
Aikido Security
Press · 27 Oct 2026, 07:00 · Node2Shell: Node.js Brotli vulnerability allows remote code execution (CVE-2026-111497) and the fix - Aikido Security
Cybernews
Press · 27 Oct 2026, 07:00 · Node.js sounds the alarm: code used by Netflix has a critical flaw - Cybernews
The Hacker News
Press · 27 Oct 2026, 04:37 · CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution - The Hacker News
Security Boulevard
Press · 27 Oct 2026, 03:08 · Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497) - Security Boulevard
Tenable Blog
Press · 27 Oct 2026, 01:19 · Brotli2Shell: Frequently asked questions for Google Brotli decoder vulnerability (CVE-2026-111497)
"CVE-2026-111497" - Google News
Press · 26 Oct 2026, 22:10 · Microsoft patches critical Brotli flaw in .NET and Visual Studio - The Next Web
www.theregister.com - Articles
Press · 26 Oct 2026, 17:58 · Microsoft releases emergency .NET security fixes for Google Brotli bug
The Hacker News
Press · 26 Oct 2026, 17:45 · PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw - The Hacker News
Rapid7
Press · 26 Oct 2026, 17:36 · CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder - Rapid7
Rapid7 Cybersecurity Blog
Press · 26 Oct 2026, 17:32 · CVE-2026-111497: Critical out-of-bounds write in the Node.js Brotli decoder
Mezha.net
Press · 26 Oct 2026, 17:14 · Critical ‘HTTP2Shell’ Brotli flaw prompts emergency patches - Mezha.net
Akamai
Press · 26 Oct 2026, 17:03 · Inside Node2Shell: A Closer Look at CVE-2026-111497 - Akamai
CyberSecurityNews
Press · 26 Oct 2026, 16:45 · PHP Releases New Windows Build Security Updates to Fix Critical HTTP2Shell Vulnerability - CyberSecurityNews
SOC Prime
Press · 26 Oct 2026, 16:41 · CVE-2026-111497: Critical Node2Shell Vulnerability - SOC Prime
BleepingComputer
Press · 26 Oct 2026, 16:27 · Critical 'HTTP2Shell' Brotli vulnerability triggers emergency patches - BleepingComputer
BleepingComputer
Press · 26 Oct 2026, 15:38 · Microsoft releases emergency .NET patches for critical Brotli flaw - BleepingComputer
SecurityWeek
Press · 26 Oct 2026, 10:21 · Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages - SecurityWeek
FortiGuard Labs | FortiGuard Center - IR Advisories
Press · 26 Oct 2026, 07:00 · Node2Shell CVEs
Tech Critter
Press · 25 Oct 2026, 23:00 · HTTP2Shell Flaw: Critical Brotli Vulnerability Explained - Tech Critter
wiz.io
Press · 25 Oct 2026, 14:46 · Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability - wiz.io
Hokanews
Press · 24 Oct 2026, 14:29 · HTTP2Shell Flaw Raises Security Concerns Over Google’s Brotli Compression Library - Hokanews
Hacker News
Press · 24 Oct 2026, 13:36 · Broccoli2Shell: Brotli decoder RCE (CVE-2026-111497) in Node.js, Python and more
The Hacker News
Press · 24 Oct 2026, 08:50 · Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - The Hacker News
Aikido Security
Press · 23 Oct 2026, 21:27 · Node2Shell Brotli vuln (CVE-2026-111497) evolves to HTTP2Shell, as libraries and apps using HTTP are affected. - Aikido Security
Salesforce
Press · 23 Oct 2026, 19:01 · What You Need to Know About the Critical PHP Vulnerabilities (PHP2Shell) - Salesforce
Qualys
Press · 23 Oct 2026, 12:58 · Node.js Patches Brotli Remote Code Execution Flaw: Find Vulnerable Runtimes Before Attackers Do - Qualys
SOC Prime
Press · 23 Oct 2026, 11:27 · CVE-2026-111497: Node.js Brotli Decoder Flaw Enables Remote Code Execution - SOC Prime
Una Al Día
Press · 23 Oct 2026, 08:01 · Node.js corrige fallos graves de TLS y Brotli en sus ramas 26, 24 y 22
The Hacker News
Press · 23 Oct 2026, 07:54 · Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data - The Hacker News
Rescana
Press · 23 Oct 2026, 06:00 · Node2Shell: Node.js Brotli Flaw CVE-2026-111497 Added to CISA KEV, Upgrade to 22.23.4, 24.22.1 or 26.12.1 - Rescana
Hacker News
Press · 23 Oct 2026, 00:54 · Node2Shell: Node.js Brotli vulnerability allows remote code execution
Una Al Día
Press · 22 Oct 2026, 13:37 · Node.js corrige un fallo en Brotli que abre la puerta a ejecución remota de código
The Hacker News
Press · 22 Oct 2026, 07:47 · Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions - The Hacker News
OX Security
Press · 22 Oct 2026, 07:00 · Node.js Brotli Decoder Out-of-Bounds Write (RCE) – CVE-2026-111497 - OX Security
Hacker News
Press · 21 Oct 2026, 23:58 · Node.js Brotli RCE (CVE-2026-111497)
Tenable Blog
Press · 21 Oct 2026, 09:01 · php2shell (CVE-2026-109618, CVE-2026-109619): Frequently asked questions about critical PHP remote code execution vulnerabilities

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

024681002 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 8.8Reality 8.803 Nov 2026 · HIGH ATTENTION + OBSERVED EXPLOITATIONHype 8.2Reality 8.8Nov 2Nov 3

━ Hype Score (Perceived)  ━ Reality threat priority. Definition changes are not new attacks.

Public exploit evidence

16

Public exploit entries / repo candidates

See 16 repos with metrics
RepositoryStarsForksLanguageUpdated
dimasma0305/CVE-2026-111497-POC7423Python25 Oct 2026, 01:09
syrex1013/CVE-2026-111497-node2shell5112Python25 Oct 2026, 20:32
caveeroo/cve-2026-111497-wordpress-poc2811Python28 Oct 2026, 23:29
CaterMaoZi/CVE-2026-111497-POC173Python24 Oct 2026, 04:24
ZeroHackOrg/node2shell-poc84JavaScript23 Oct 2026, 11:17
GlobularOne/HTTP2Shell-PoC41Python25 Oct 2026, 04:29
TheFool-TAROT/CVE-2026-111497-brotli-pwn30JavaScript22 Oct 2026, 16:31
googlesky/CVE-2026-11149720C24 Oct 2026, 07:12
Nyamort/brotli-pingback-lab11Python31 Oct 2026, 18:05
Ghost-Bx1/DotNet-HTTP2Shell-CVE-2026-11149700Python01 Nov 2026, 04:27
Ghost-Bx1/Node2Shell-CVE-2026-11149700Python01 Nov 2026, 04:27
mahumadad/CVE-2026-111497-assessment00Python24 Oct 2026, 03:17
malikad778/php2shell-guard00PHP24 Oct 2026, 07:05
s1ko/poc-cve-2026-11149700Python24 Oct 2026, 15:19
Saturate/CVE-2026-11149700—23 Oct 2026, 04:29
timosar/woff2shell00Python29 Oct 2026, 09:53
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.2; EPSS 82.6%
Attention, last 30 days
63 distinct story titles; 63 press documents; 15 publisher domains.
Technical potential
network access, no prior privileges, no user interaction, additional attack conditions.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:53.577903+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
First press mention
21 Oct 2026, 09:01
Published
22 Oct 2026, 13:35
Added to the CISA KEV catalog
27 Oct 2026, 00:00
Latest press mention
03 Nov 2026, 06:00
Score calculated
05 Nov 2026, 13:59
Name
Log4Shell
PoCs on GitHub
16 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar