Access Server: CVE-2026-111497 in Google Brotli decoder

Also Known As: Node2Shell, HTTP2Shell, Python2Shell, Broccoli2Shell.

Impact on Access Server: Negligible.

Details:

OpenVPN Access Server doesn't include Brotli components. Although we compress Access Server frontend files using Brotli during the build process and distribute them as encoded files, the vulnerability affects Brotli decompression, which occurs on the client side.

The vulnerability may affect external applications, such as web browsers, that use a vulnerable Brotli decoder when accessing the Access Server web interface. Remediation must occur in these external applications, not in Access Server.

Remediation:

Update affected web browsers and other web client applications to versions that address this vulnerability.

Need Help?

If you have questions, submit a support ticket.