Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up

Sweet Security has detailed how its runtime protection tool, Virtual Patching, neutralizes HTTP2Shell (CVE-2026-111497), a critical remote-code-execution flaw in the Brotli compression library used by Node.js, Bun, Envoy, Python and other runtimes, HTTP libraries and proxies. A malformed compressed stream can trick Brotli's decoder into overflowing an internal buffer, letting an unauthenticated attacker run arbitrary code, and because Brotli ships as countless separate copies across containers, binaries and vendor bundles, each instance must be patched individually, leaving a long exposure window. Sweet says it has already seen exploitation attempts in 88% of the environments it monitors, since the underlying fix sat unflagged in Brotli's source for roughly eight months before the advisory. Using an eBPF-based sensor with no sidecars or code changes, Sweet identifies which running services actually load and execute the vulnerable library and are internet-reachable, then lets teams block the specific malicious system call (process creation from the decompression path) with one click, buying time to apply the real fix. The company is also offering free 30-day protection against this flaw through its Sweet Safety Net offering.