The HTTP2Shell issue extends beyond web servers: new research shows the same flaw in the Brotli decoder (CVE-2026-111497) can affect .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads.
The work, published October 25 by JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan, traces CVE-2026-111497 through multiple software stacks and demonstrates a variety of failure modes.
Depending on how an application uses the compromised decoder, JFrog observed crashes, memory corruption, and an endless decoding loop.
Originally disclosed in Node.js security updates on October 21, the bug lies in Google’s Brotli decoder rather than in HTTP itself. An invalid block-switch code can be misinterpreted as a request for more input, leaving the decoder in a broken internal state and enabling a write beyond the intended memory buffer. Upstream affected releases include Brotli 1.0.3 through versions before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.
Because some projects have backported fixes without updating the upstream version numbers, teams should check vendor patch records and advisories rather than relying solely on library version strings.
How the bug affects other projects
In FFmpeg, JFrog reached the vulnerable decoder through libjxl, which handles JPEG XL images. A specially crafted image contained malformed Brotli data inside a compressed metadata box; when libjxl decoded that box, memory corruption occurred and the process crashed during cleanup. The researchers demonstrated control over a corrupted pointer value, but did not develop a complete remote-code-execution exploit for FFmpeg in their tests.
This file-based attack path adds to existing concerns about FFmpeg and media-file parsing bugs, though those prior reports concern different vulnerabilities.
JFrog also induced a native crash via .NET’s Brotli decompression APIs. A two-stage stream left the decoder in an invalid state, and a subsequent memory operation accessed memory outside the valid heap, producing a segmentation fault that terminated the process rather than a managed exception. The demonstration used a local console application, but the same decoder paths exist in HttpClient response decompression and ASP.NET Core request-decompression middleware. Microsoft announced on October 25 that it is rolling out updates for supported .NET runtimes and SDKs.
ClickHouse crashed after receiving a single crafted HTTP request with a 23 MB Brotli-compressed body. Decoder corruption caused a crash during cleanup that stopped the tested server and interrupted active queries. JFrog reported that a fix was merged for ClickHouse, but a patched release had not been published when the research was released.
Apache Arrow showed a different failure mode: a 534‑byte input sent through pyarrow’s Brotli decoding path entered an endless loop that consumed CPU and blocked completion. The same input is rejected in under a second by Brotli 1.2.1. At publication, Arrow’s tracking issue remained open.
Sysdig’s Threat Research Team notes that Node.js fixes were released in versions 22.23.4, 24.22.1, and 26.12.1; the 24.22.1 release notes confirm the Brotli patch. Other affected applications will need their own rebuilt binaries or updated library packages from their maintainers or vendors.
Teams are advised to trace how untrusted files, buffers, requests, and responses flow into decompression code. JFrog’s scanner can help identify potential exposure paths, but a detected match does not by itself prove remote exploitability.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
