HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow

Key Points:

• The HTTP2Shell vulnerability (CVE-2026-111497) affects the Brotli decoder used beyond web traffic, impacting .NET applications, FFmpeg, ClickHouse servers, and Apache Arrow workloads by causing crashes, memory corruption, and endless loops.
• The flaw resides in Google’s Brotli decoder and can cause a write beyond the intended memory buffer due to an invalid block switch, with affected versions including Brotli 1.0.3 to before 1.0.10, 1.1.0 to before 1.1.1, and 1.2.0 to before 1.2.1.
• Research showed FFmpeg crashes from malformed Brotli data in JPEG XL metadata, .NET applications experiencing segmentation faults during Brotli decompression, and ClickHouse servers crashing from crafted Brotli-compressed HTTP requests, with some fixes merged but not yet widely released.
• Apache Arrow suffers from an endless CPU-consuming loop triggered by a specific Brotli input, which was mitigated in Brotli 1.2.1, though the issue remained open in Arrow at the time of publication.
• Node.js patches addressing the vulnerability have been released, but other affected software requires independent updates; organizations are advised to carefully track decompression paths in their systems and verify vendor patches rather than relying solely on version numbers.