# Question regarding HashiCorp Vault OSS exposure to Brotli vulnerability

**URL:** <https://discuss.hashicorp.com/t/question-regarding-hashicorp-vault-oss-exposure-to-brotli-vulnerability/77922>\
**Category:** Vault\
**Tags:** vault\
**Created:** [October 28, 2026, 7:03pm UTC](https://discuss.hashicorp.com/t/question-regarding-hashicorp-vault-oss-exposure-to-brotli-vulnerability/77922 "2026-10-28T19:03:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ushanay](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/ushanay/32/27373_2.png) [@ushanay](https://discuss.hashicorp.com/u/ushanay)\
**Post date:** [October 28, 2026, 7:03pm UTC](https://discuss.hashicorp.com/t/question-regarding-hashicorp-vault-oss-exposure-to-brotli-vulnerability/77922/1 "2026-10-28T19:03:37Z")

</div>

Hi everyone,

I recently read a security advisory regarding the **HTTP2Shell vulnerability (CVE-2026-111497)** in Google’s Brotli compression library.

While initial reports focused primarily on Node.js and C implementations, recent findings from [HTTP2Shell: Go Brotli Vulnerability, Risks and Remediation](https://www.sweet.security/blog/http2shell-sweet-security-confirms-brotli-vulnerability-also-affects-native-go-implementations) confirm that the native Go port of ( [GitHub - andybalholm/brotli: Pure Go Brotli encoder and decoder · GitHub](http://github.com/andybalholm/brotli) v1.2.0 // indirect) is also vulnerable up to version 1.2.6. In Go environments, processing a malformed Brotli-compressed HTTP payload can trigger an out-of-bounds runtime panic, leading to a potential Denial of Service (DoS).

Given that HashiCorp Vault is built on Go, I wanted to ask the community :

1. **Is Vault exposed to this vulnerability?** Does Vault utilize the Brotli library either directly or transitively through its HTTP infrastructure/dependencies?
2. **Is request/response decompression handled anywhere?** If the dependency exists, are there active code paths where Vault attempts to decompress untrusted, attacker-controlled Brotli payloads?
3. **Are there any planned updates?** If Vault is affected, is there a timeline for upgrading the dependency to the patched version (`v1.2.7` or later)?

Any insights on potential exposure or mitigation recommendations would be greatly appreciated.

Thanks in advance,