Brotli Decoder Flaw CVE-2026-111497 Spreads to .NET, FFmpeg, and ClickHouse

Key points

• The vulnerability, dubbed HTTP2Shell or Broccoli2Shell, stems from an error in the Brotli decoder’s block-switching logic, leading to memory corruption.
• JFrog researchers demonstrated that the flaw affects FFmpeg via JPEG XL images, ClickHouse via HTTP requests, and Apache Arrow via compressed data, causing crashes or infinite loops.
• Microsoft released out-of-band updates for .NET 8, 9, 10, and 11 RC3 on October 25, while Node.js, Bun, and Envoy also issued fixes.
• Wiz reports that 91% of cloud environments have vulnerable resources, with 82% exposing Node.js instances, highlighting the widespread risk.
• No real-world exploitation has been reported, but CISA and Red Hat note that no reliable public proof-of-concept exists for remote code execution on all affected platforms.

Background

This vulnerability was first disclosed on October 21, 2026, when Node.js and Google released fixes for CVE-2026-111497. The flaw was originally discovered by OpenAI’s Codex Security team in February but was not recognized as a security issue until its public disclosure. Earlier coverage in our archive does not provide relevant background for this specific technical vulnerability, as it focuses on unrelated topics such as sports and football.

How outlets are covering it

Cyber Security News and The Hacker News emphasize the broad impact of the vulnerability on non-web applications like FFmpeg and ClickHouse, highlighting that file-based inputs can also trigger the flaw. Wiz.io focuses on the cloud environment risk, noting that 91% of cloud environments are vulnerable. Aikido Security provides detailed patch status across various platforms, including Linux distributions, and offers temporary workarounds for those unable to patch immediately. All sources agree on the critical nature of the vulnerability but differ in their emphasis on specific affected software and remediation strategies.

Why it matters

The widespread use of Brotli compression in web and non-web applications makes this vulnerability a significant risk for organizations. Failure to patch could lead to memory corruption, data leakage, or remote code execution, potentially compromising sensitive data and system integrity. The lack of patches for some platforms, such as Ubuntu and SUSE, increases the urgency for organizations to implement temporary mitigations or use patched container images.

What to watch

Organizations should prioritize updating affected software to patched versions, including Node.js, .NET, Python packages, and other listed platforms. For those unable to patch immediately, disabling Brotli decompression or rejecting Brotli-encoded requests can reduce exposure. Security teams should monitor for exploitation attempts and ensure that all dependencies, including transitive ones, are updated. Continued vigilance is required as more platforms and distributions release fixes.