Sweet Security Offers Free 30-Day Virtual Patch for HTTP2Shell CVE-2026-111497

Sweet Security announced on 27 Oct 2026 that it will provide a 30-day free virtual patch, dubbed Sweet Safety Net, to every organization affected by the HTTP2Shell vulnerability (CVE-2026-111497). The offer applies to all environments that run the vulnerable Brotli decoder, including Node.js, Bun, Python, Envoy, Istio, and Go frameworks such as Traefik, Fiber, and Iris. The patch is delivered through Sweet Security’s runtime sensors and does not require any code changes or a purchase commitment.

How HTTP2Shell Exploits Work

HTTP2Shell is a remote code execution flaw that lives inside the Brotli decompression library embedded in several popular runtimes. When an attacker sends a specially crafted HTTP request, the decoder can execute arbitrary code on the host. The vulnerability is present in the compiled binaries that applications bundle, so patching requires updating every dependency that includes the decoder, rebuilding the application, and redeploying it across production. For most organizations, that process can take weeks.

Sweet Safety Net’s Runtime Protection

Sweet Security’s virtual patch operates at the application layer. Sensors installed on each node intercept traffic that matches the exploitation signature and block it before it reaches the vulnerable code path. Legitimate traffic continues to flow unimpeded. The policy is applied through Sweet Security’s Vulnerabilities Catalog and is automatically distributed to all nodes running the affected workload. Once enforcement is confirmed, the workload receives a Protected status that follows it through scaling and restarts.

Current Exploitation Landscape

Sweet Security reports that 88% of the environments it monitors are currently experiencing active exploitation attempts. The company’s sensors have already detected and blocked attacks in real-world deployments. The free 30-day window gives organizations time to schedule the permanent fix—updating dependencies, rebuilding, testing, and redeploying—without remaining exposed.

How to Claim the Free Protection

Organizations that are not Sweet Security customers can claim the free protection by visiting Hi. The claim process requires no purchase or subscription. Once the sensor is installed, the virtual patch policy is automatically applied and the workload is marked Protected.

What This Means for Your Security Posture

  • Immediate Mitigation: The virtual patch stops exploitation at the network boundary, reducing the risk of data loss or system compromise.
  • No Code Changes: The solution requires no modification to application code or deployment pipelines.
  • Temporary Coverage: The protection is valid for 30 days, after which organizations must apply the permanent fix.
  • Broad Coverage: The vulnerability spans multiple runtimes and frameworks, so the patch applies to a wide range of applications.

Next Steps for Affected Teams

  1. Verify whether your environment uses any of the affected runtimes or frameworks.
  2. Install Sweet Security sensors if not already present.
  3. Apply the Sweet Safety Net policy from the Vulnerabilities Catalog.
  4. Schedule the permanent patch cycle—update dependencies, rebuild, test, and redeploy.
  5. Monitor sensor logs to confirm enforcement and protection status.

The HTTP2Shell vulnerability follows a pattern of runtime-level exploits that surface when core libraries are not updated promptly. Similar incidents include the PHP2Shell exploitation that led CISA to order federal agencies to patch, and the Brotli flaw in .NET that prompted Microsoft to issue emergency fixes. Organizations should review their dependency management practices and consider runtime virtual patching as a bridge until permanent fixes are in place.

Final Note

Sweet Security’s free 30-day virtual patch provides a practical stopgap against a widespread and actively exploited vulnerability. By applying the policy immediately, teams can halt exploitation while they prepare the long-term fix. The offer ends on 27 Nov 2026, so action is required before the window closes.

Explore more on this topic