Impact of CVE-2026-111497 on Symantec Protection Engine (SPE)

Products

• Protection Engine for Cloud Services

Issue/Introduction

Is Symantec Protection Engine (SPE) affected by CVE-2026-111497 (also referred to in the industry as "http2shell")?

Environment

• Symantec Protection Engine (SPE): Version 9.3.x
• CVE-2026-111497

Resolution

Symantec Protection Engine (SPE) 9.3 is NOT impacted by CVE-2026-111497.

Additional Information

• CVE-2026-111497 is an out-of-bounds write vulnerability found in the Brotli decompression library. Symantec Protection Engine does not utilize the Brotli decompression library in a vulnerable configuration. Additionally, "HTTP2Shell" is a community-attributed nickname and does not represent a component, feature, or tool within the Symantec Protection Engine architecture.
• No action or remediation is required for SPE installations regarding this CVE.