Critical Brotli “HTTP2Shell” Flaw Prompts Emergency Patches Across Ecosystems
Summary
CVE-2026-111497, a Brotli decoder buffer overflow, can expose memory or enable remote code execution when applications decompress malicious data. Patches are available; PoCs are public, but no in-the-wild exploitation is reported.
Key points
- The flaw, also called Broccoli2Shell and Node2Shell, affects Brotli versions 1.0.3–1.0.9, 1.1.0, and 1.2.0.
- A malformed Brotli stream can cause the decoder to append input beyond an internal eight-byte buffer, corrupting nearby memory.
- Exploitation requires an application to decompress attacker-controlled Brotli data, such as a malicious response or request.
- Node.js says exploitation can crash a process, expose memory, or enable remote code execution; Microsoft also warned of privilege escalation on vulnerable .NET systems.
- Fixes are available for Google Brotli, Node.js, Python Brotli, and brotlicffi; published PoCs exist, but no malicious exploitation in the wild has been reported.
- After patching, administrators should restart affected processes and rebuild and redeploy affected container images. Blocking inbound Brotli requests alone does not address malicious-response attacks.
Article Details
- Vulnerability Types
- Buffer overflow
- Severity
- Critical
- Affected Versions
- Brotli 1.0.3–1.0.9
- Brotli 1.1.0
- Brotli 1.2.0
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Remove Brotli support from Python applications.
- Block incoming Brotli-compressed requests at the proxy or firewall; this does not block the malicious HTTP-response route.
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationMicrosoft warned that successful exploitation in a vulnerable .NET version can allow privilege escalation.T1190 · Exploit Public-Facing ApplicationA malicious Brotli-compressed request sent directly to a server can trigger the vulnerability in its decoder.T1203 · Exploitation for Client ExecutionA client application can trigger the vulnerability when it decompresses a malicious Brotli-compressed HTTP response.
CVE
Vendors
GoogleBrotli is an open-source project developed and maintained by Google for lossless data compression.MicrosoftOn Sunday, Microsoft pushed an emergency security update to address the issue in .NET, warning that successful exploitation allows privilege escalation on systems with a vulnerable .NET version.
Products
.NETOn Sunday, Microsoft pushed an emergency security update to address the issue in .NET, warning that successful exploitation allows privilege escalation on systems with a vulnerable .NET version.BrotliCritical 'HTTP2Shell' Brotli vulnerability triggers emergency patchesNode.jsA critical flaw dubbed 'HTTP2Shell' in Brotli, the C decoder library built into Node.js, could allow attackers to corrupt memory and access sensitive data.