Is MetaDefender Industrial Firewall affected by CVE-2026-111497?
Answer
Yes, in a limited way. MetaDefender Industrial Firewall ships an affected version of the Google Brotli library. The firewall's traffic enforcement, its web interface and its API do not decode Brotli data and are not affected. The one affected feature is packet capture in Diagnostics: when a capture that contains cleartext HTTP traffic is opened or analyzed on the appliance, the capture analyzer decodes Brotli-compressed HTTP content with the affected library.
Until version 3.5.2 is installed, do not create HTTP rules in Firewall Rules, and avoid opening packet captures in Diagnostics in the cases listed under Action required below.
About the vulnerability
HTTP2Shell (also reported as Node2Shell and Broccoli2Shell) is a buffer overflow in the Brotli decoder (c/dec/decode.c) of Google Brotli versions 1.0.3 through 1.2.0. It was disclosed on 21 October 2026. A remote, unauthenticated attacker can use a crafted Brotli-compressed stream to corrupt decoder memory, disclose memory contents, cause a denial of service, or potentially execute arbitrary code. The fixed upstream versions are Brotli 1.0.10, 1.1.1 and 1.2.1. The vulnerability is rated CVSS v4 9.2.
How MetaDefender Industrial Firewall is affected
Component | Uses the Brotli decoder? | Affected? |
|---|---|---|
Firewall data plane (traffic inspection and enforcement, including HTTP rules) | No. The library is present in memory but is never called on network traffic. HTTP rules match connections; they do not decompress HTTP content. | No |
Web management interface and REST API | No. The web server has no Brotli module, and the management backend does not use Brotli. | No |
Packet capture in Diagnostics | Yes. When packet capture in Diagnostics is used while an HTTP rule exists in Firewall Rules | Yes |
Encrypted traffic, including HTTPS and HTTP/3 (QUIC), is not decoded by the capture analyzer and does not trigger the vulnerability. Recording a capture does not trigger it; only analyzing the capture on the appliance does.
Effect of firewall rules. In Transparent mode with Protect enforcement, traffic that no rule allows is dropped before it reaches a capture. Removing rules that allow cleartext HTTP therefore keeps that traffic out of captures in this configuration only. It does not protect:
Learning or Monitor mode, where traffic not matching a rule is still forwarded and captured (except with Strict Monitor Mode).
Captures on Routing mode ports, which record traffic as it arrives, before firewall rules are applied.
Traffic on standard HTTP ports allowed by a rule other than an HTTP rule (for example a TCP port rule or a broad allow rule).
For this reason, Action required below combines not creating HTTP rules with not opening captures in these cases.
Affected versions
All supported versions of MetaDefender Industrial Firewall up to and including 3.5.1.
Will be fixed in: 3.5.2. This release updates the Brotli library and turns off HTTP content decompression in the on-device capture analyzer.
Action required
Until version 3.5.2 is installed:
Do not create HTTP rules in Firewall Rules.
Do not open packet captures in Diagnostics when another rule, such as a TCP port rule or a broad allow rule, allows traffic on standard HTTP ports (80, 8080, 3128, 8088).
References
CVE-2026-111497
Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2026-111497
Last reviewed: October 2026