GoKawiilBrotli decoder flaw CVE-2026-111497 prompts Microsoft emergency patch
A critical buffer overflow in the Brotli compression library, affecting versions 1.0.3-1.0.9, 1.1.0 and 1.2.0, can let attackers craft malicious compressed streams that corrupt memory on vulnerable decoders. The bug, nicknamed HTTP2Shell, Broccoli2Shell or Node2Shell, originated in Node.js but also touches Python libraries like urllib3, requests, httpx and aiohttp, prompting Microsoft to ship an emergency .NET update on Sunday.