HTTP2Shell Vulnerability Affects .NET, FFmpeg, ClickHouse and Apache Arrow

Introduction

The HTTP2Shell vulnerability is raising concerns beyond Node.js, as security researchers have identified additional software platforms affected by a flaw in Google’s Brotli decompression library. Tracked as CVE-2026-111497, the vulnerability can cause application crashes, memory corruption, or excessive CPU consumption, depending on how the affected software handles malformed compressed data.

Research published by JFrog on October 25, 2026, describes impacts involving .NET applications, FFmpeg media processing, ClickHouse database servers, and Apache Arrow. The findings highlight why organizations should examine their complete software dependencies rather than checking Node.js versions alone.

What Is CVE-2026-111497?

Brotli is a compression algorithm used to reduce data sizes and improve transfer efficiency. The vulnerability originates in the decoder’s handling of malformed block-switching data. Under certain conditions, invalid decoder state can lead to memory corruption or prevent decompression from completing.

Affected upstream Brotli releases include versions 1.0.3 through versions before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1. However, software vendors may backport fixes without changing the upstream version number. Administrators should therefore consult official vendor advisories and package security records before determining whether a system remains vulnerable.

How the Vulnerability Affects Different Platforms

.NET Applications

Researchers demonstrated that malformed Brotli data could crash a .NET application through its decompression APIs. The issue can become particularly important when applications process untrusted compressed content. Depending on the affected runtime and execution path, a native crash may terminate the process rather than produce an ordinary managed exception.

FFmpeg and Media Processing

In the FFmpeg ecosystem, researchers traced a path through libjxl, which processes JPEG XL images. Malformed compressed metadata triggered memory corruption and a crash during cleanup. The demonstration established a denial-of-service and memory-corruption concern, but did not prove a complete remote code execution exploit against FFmpeg.

ClickHouse Database Servers

Testing against ClickHouse showed that a crafted HTTP request could crash the tested server during Brotli decoder cleanup. A server crash can interrupt active queries and affect service availability. JFrog reported that a fix had been merged, although a patched release was not yet available when the research was published.

Apache Arrow

Apache Arrow demonstrated a different failure. A small compressed input caused the affected pyarrow decoding path to enter an endless loop, consuming CPU resources until an external watchdog terminated the process. Researchers reported that Brotli 1.2.1 rejected the same input quickly, illustrating the importance of applying appropriate fixes.

Security Risks and Recommended Mitigations

Organizations should identify applications that bundle or depend on Brotli, including runtimes, media-processing pipelines, databases, and data-analysis services. Review vendor security advisories, upgrade to confirmed patched releases, and rebuild applications where necessary.

Security teams should also examine whether untrusted HTTP responses, uploaded files, or compressed datasets reach vulnerable decoding functions. Apply sensible request-size limits, processing timeouts, and resource controls as additional safeguards. These measures reduce exposure but should not replace installing the appropriate vendor fix.

Automated dependency scanners can help identify potentially affected components, although a dependency match alone does not establish that a system is remotely exploitable. Validate findings against the actual software configuration and reachable decoding paths.

Conclusion

CVE-2026-111497 demonstrates how a flaw in a shared compression library can affect multiple technology stacks. Organizations should assess their complete dependency inventory, confirm patch availability with each vendor, and prioritize systems that process untrusted compressed content. Looking beyond Node.js is essential to reducing the risk of service disruption and memory-safety failures associated with the HTTP2Shell vulnerability.