Aikido
A European security research company focused on software supply chain and application security, offering code and dependency vulnerability scanning and a security platform.
Timeline (last 90 days)
Security research firm Aikido disclosed the HTTP2Shell vulnerability, tracked as CVE-2026-111497, which is related to the Brotli decompression stage and could allow attackers to achieve remote code execution.
Aikido's analysis points out that the same defect pattern also exists in Python's HTTP handling stack, especially when an application uses Brotli compression and delegates decompression to an underlying library, where maliciously crafted compressed data may trigger out-of-bounds or injection behavior.
Aikido recommends paying attention to official patches and advisories and adding dependency scanning to CI pipelines, because the vulnerability involves the HTTP request handling path, and even if an application does not directly call Brotli it may still be passively exposed through framework default configurations.
All Facts (3)
Security research firm Aikido disclosed the HTTP2Shell vulnerability, tracked as CVE-2026-111497, which is related to the Brotli decompression stage and could allow attackers to achieve remote code execution.
50%UnverifiedAikido's analysis points out that the same defect pattern also exists in Python's HTTP handling stack, especially when an application uses Brotli compression and delegates decompression to an underlying library, where maliciously crafted compressed data may trigger out-of-bounds or injection behavior.
50%UnverifiedAikido recommends paying attention to official patches and advisories and adding dependency scanning to CI pipelines, because the vulnerability involves the HTTP request handling path, and even if an application does not directly call Brotli it may still be passively exposed through framework default configurations.
50%