HTTP2Shell Vulnerability Exposes .NET, FFmpeg, and More

Key Takeaways

• The HTTP2Shell vulnerability (CVE-2026-111497), rooted in a Brotli decoder flaw, extends far beyond initial Node.js concerns.
• Affected software includes .NET applications, FFmpeg, ClickHouse servers, and Apache Arrow workloads.
• Impacts range from application crashes and memory corruption to infinite decoding loops, varying by application.
• Patches are available for Node.js and are being rolled out for .NET, but other vendors require specific updates.
• Organizations must verify vendor-specific patches rather than relying solely on upstream Brotli version numbers.

Widespread Brotli Decoder Flaw Impacts .NET, FFmpeg, and More

New research has unveiled that the HTTP2Shell vulnerability, identified by CVE-2026-111497, is not confined to web traffic and Node.js. This critical flaw, residing within the Google Brotli decoder, has been found to compromise a broader spectrum of applications, including .NET frameworks, FFmpeg media processing tools, ClickHouse database servers, and Apache Arrow data processing workloads.

The findings, published on October 25 by JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan, demonstrate that merely checking Node.js versions is insufficient to mitigate the risk, as other widely used software also incorporates the vulnerable library. Their investigation details various consequences, such as crashes, memory corruption, and even infinite decoding loops, depending on how each application implements the susceptible Brotli library.

Understanding the Core Vulnerability

Initially disclosed during Node.js security updates on October 21, the root cause of CVE-2026-111497 lies within Google’s Brotli decoder, not the HTTP protocol itself. The vulnerability stems from an invalid block switch within the Brotli decompression process, which can be misinterpreted by the decoder as a request for additional input. This misinterpretation leads to continued processing with a corrupted decoder state, ultimately enabling a write operation beyond the intended memory buffer.

Affected upstream Brotli releases include versions 1.0.3 through those preceding 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. It is crucial for development teams to note that projects may integrate the necessary fixes without necessarily upgrading to these specific upstream Brotli versions. Therefore, relying solely on version numbers is inadequate; organizations must consult individual vendor patch records for accurate remediation status.

Impact on Key Applications

FFmpeg: Crafted Images Lead to Crashes

In the case of FFmpeg, researchers successfully exploited the decoder through libjxl, a library responsible for processing JPEG XL images. A specially crafted image containing malformed Brotli data within a compressed metadata box caused memory corruption upon decoding by libjxl, resulting in a crash during the cleanup phase. While the test allowed attackers to control a corrupted pointer value, it did not confirm a full remote code execution exploit for FFmpeg. This file-based attack vector adds to existing concerns regarding FFmpeg media-file vulnerabilities and other memory-corruption flaws, though these are distinct vulnerabilities from HTTP2Shell.

.NET: Segmentation Faults and Process Termination

JFrog also demonstrated a native crash within .NET applications by exploiting its Brotli decompression APIs. A two-stage stream left the decoder in an invalid state, leading to a memory operation that accessed data outside the valid heap. Unlike typical managed exceptions, this resulted in a segmentation fault that abruptly terminated the process. The proof-of-concept utilized a local console application, but similar decoder paths exist in HttpClient response decompression and ASP.NET Core request-decompression middleware. Microsoft confirmed on October 25 that it is actively deploying updates for all supported runtimes and SDKs.

ClickHouse: Server Crashes from Malformed Requests

ClickHouse servers were susceptible to failure after processing a single, crafted HTTP request containing a 23 MB Brotli-compressed body. The decoder corruption triggered a crash during cleanup, effectively halting the tested server and disrupting ongoing queries. JFrog reported that a fix had been integrated into ClickHouse, but a patched release was not yet available at the time of their research publication.

Apache Arrow: Endless Loops and Resource Exhaustion

Apache Arrow exhibited a different failure mode. A mere 534-byte input, processed through pyarrow’s Brotli decoding path, initiated an endless loop. This loop consumed significant CPU resources and prevented the completion of operations, whereas Brotli 1.2.1 rejected the identical input in less than a second. Apache Arrow’s tracking issue for this vulnerability remained unresolved at the time of publication.

Patching and Mitigation

According to the Sysdig Threat Research Team, Node.js has released fixes in versions 22.23.4, 24.22.1, and 26.12.1, with the 24.22.1 release notes specifically confirming the Brotli patch. However, other affected applications necessitate their own updated builds or library packages from their respective vendors.

Organizations should meticulously trace untrusted files, data buffers, HTTP requests, and responses that pass through decompression code. While JFrog offers a scanner to help identify potential vulnerable paths, a match alone does not definitively confirm remote exploitability.

What You Should Do

• Identify Affected Systems: Conduct a comprehensive audit to locate all applications and services utilizing the Brotli decoder, especially those processing untrusted input (.NET, FFmpeg, ClickHouse, Apache Arrow, and Node.js).
• Prioritize Patching: Apply vendor-specific security updates immediately. For Node.js, upgrade to versions 22.23.4, 24.22.1, 26.12.1, or newer. For .NET, ensure all supported runtimes and SDKs are updated as per Microsoft’s guidance. Consult vendor advisories for FFmpeg, ClickHouse, Apache Arrow, and any other software using Brotli.
• Verify Vendor Patches: Do not rely solely on upstream Brotli version numbers. Confirm that your specific application’s vendor has integrated the fix into their distribution.
• Input Validation: Implement robust input validation and sanitization for all data processed by Brotli decompression routines, particularly for untrusted external inputs.
• Monitor for Anomalies: Deploy monitoring solutions to detect unusual CPU spikes, unexpected process terminations, or other anomalies that could indicate an attempted exploitation of this vulnerability.
• Consult JFrog Research: Leverage the information provided by JFrog’s research to understand potential attack vectors and use their scanning tools if available, recognizing that a match does not always equate to remote exploitability.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.