HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow

The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads.

The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan traced CVE-2026-111497 through several software stacks.

Their findings describe crashes, memory corruption, and an endless decoding loop, depending on how each application uses the affected library.

First disclosed in Node.js security updates on October 21, the vulnerability sits in Google’s Brotli decoder rather than HTTP itself. An invalid block switch can be mistaken for a request for more input.

Processing then continues with broken decoder state, allowing a write beyond the intended memory buffer. Affected upstream releases include Brotli 1.0.3 through versions before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.

Projects may apply the fix without changing to these upstream versions, so teams must check vendor patch records rather than relying on version numbers alone.

HTTP2Shell Vulnerability

In FFmpeg, researchers reached the decoder through libjxl, which processes JPEG XL images. A crafted image carried malformed Brotli data inside a compressed metadata box. When libjxl decoded that data, memory corruption caused a crash during cleanup.

The test showed attacker control over a corrupted pointer value. However, it did not establish a complete remote code execution exploit for FFmpeg.

This file-based route adds to concerns covered in earlier reporting on FFmpeg media-file vulnerabilities and other FFmpeg memory-corruption flaws. Those reports concern separate vulnerabilities.

JFrog also triggered a native crash through .NET’s Brotli decompression APIs. A two-stage stream left the decoder in an invalid state before a memory operation moved outside valid heap data. Unlike a normal managed exception, the resulting segmentation fault terminated the process.

The demonstration used a local console application. However, related decoder paths can serve HttpClient response decompression and ASP.NET Core request-decompression middleware. Microsoft announced on October 25 that it was rolling out updates for supported runtimes and SDKs.

ClickHouse failed after receiving one crafted HTTP request with a 23 MB Brotli-compressed body. Decoder corruption caused a crash during cleanup, stopping the tested server and interrupting active queries. JFrog reported that a fix had been merged, but no patched release had shipped when its research appeared.

Apache Arrow showed a different failure. A 534-byte input sent through pyarrow’s Brotli decoding path caused an endless loop that consumed CPU and blocked completion. Brotli 1.2.1 rejected the same input in under a second. Arrow’s tracking issue remained open at publication.

According to the Sysdig Threat Research Team, Node.js fixes were released in versions 22.23.4, 24.22.1, and 26.12.1, with the 24.22.1 release notes confirming the Brotli patch. Other applications require their own updated builds or library packages.

Teams should trace untrusted files, buffers, requests, and responses into decompression code. JFrog’s scanner helps identify potential paths, but a match alone does not prove remote exploitability.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow appeared first on Cyber Security News.