| Audience: DocuShare administrators and security teams |
Applies To
DocuShare 7.5, 7.6, and 7.7 as supplied by Xerox. This assessment addresses CVE-2026-111497, described in security reports as HTTP2Shell or Node2Shell.
Summary
DocuShare 7.5, 7.6, and 7.7 are not affected by CVE-2026-111497. The affected native Brotli implementation and the brotli4j native binding are not included in the assessed DocuShare distributions. No DocuShare shutdown or CVE-specific remediation is required for these releases.
About the Vulnerability
CVE-2026-111497 concerns a memory-corruption flaw in the native Brotli decoder. Processing maliciously crafted compressed data can cause memory corruption and may lead to a crash, disclosure of process memory, or remote code execution in an affected application.
Although the issue was reported in Node.js, other applications can be affected if they use the vulnerable native Brotli implementation. The presence of Brotli-related Java libraries does not by itself establish exposure; the implementation and its native dependencies must be identified.
Why DocuShare Is Not Affected
The product assessment identified the following distinctions:
1. The assessed DocuShare distributions do not include the native C Brotli library or brotli4j. The review included Java archives, libraries inside nested archives, and native program files.
2. Solr includes Google's Java Brotli decoder, dec-0.1.2.jar. This is a different implementation from the affected native C decoder. The upstream fix for this CVE changed only the native C decoder, not this Java implementation.
3. The Netty Brotli functionality included with DocuShare requires brotli4j. Because the assessed distributions do not include brotli4j, that functionality cannot use the affected native decoder.
Required Action
You do not need to stop DocuShare or apply a DocuShare-specific workaround for this CVE on the listed releases. Do not manually remove or replace DocuShare's Solr, Netty, or Brotli libraries solely to address this advisory.
Assess any separately installed applications, native libraries, or customer-added integrations independently using the guidance from their respective vendors. The DocuShare assessment does not establish that other software on the server is unaffected.
If a Security Scan Reports This CVE
Identify the exact file path, component name, version, and detection method reported by the scanner. A finding based only on the name Brotli, Netty, or a Java archive does not establish that the affected native decoder is present or used.
If the finding identifies a component supplied with DocuShare, contact Xerox DocuShare Support before changing the installation. Provide the scanner evidence, CVE identifier, detected file path and version, and your DocuShare version and patch level.
Assessment Scope
This article is limited to CVE-2026-111497 and the assessed DocuShare 7.5, 7.6, and 7.7 distributions. It does not extend the assessment to other DocuShare releases, other products, customer modifications, or unrelated vulnerabilities. Java applications that load a vulnerable native Brotli decoder require their own assessment.
References
Node.js: October 21, 2026 Security Releases
Comments
0 comments
Article is closed for comments.