HTTP2Shell Brotli flaw affects net FFmpeg ClickHouse and Apache Arrow
Research shows a critical Brotli decoder vulnerability extends past web servers into multiple software frameworks, causing system crashes and memory corruption.
FTMQ Security, written by our newsroom0 views
A critical Brotli decoder vulnerability affects .NET, FFmpeg, ClickHouse, and Apache Arrow in addition to HTTP web traffic, CyberSecurityNews reported on October 27. The flaw, tracked as CVE-2026-111497, means that updating Node.js alone will leave other exposed applications open to attack. [1]
According to CyberSecurityNews, findings published on October 25 by JFrog researchers Aviv Engelberg, Eddy Tsalolikhin, and Ofri Ouzan traced CVE-2026-111497 across several software stacks. The research demonstrates that the flaw can trigger application crashes, memory corruption, and an endless decoding loop depending on how the software integrates the decoder. [1]
Apache Arrow is a language-agnostic framework created for data analytics applications that process columnar data. It uses a standardized column-oriented memory format to run efficient operations on modern CPU and GPU hardware, which reduces constraints on dynamic random-access memory. [3][5]
Security teams must audit all software stacks using the Brotli decoder rather than relying solely on web server and Node.js updates, CyberSecurityNews reported. [1]
In short
- CVE-2026-111497 impacts .NET, FFmpeg, ClickHouse, and Apache Arrow.
- JFrog researchers discovered the Brotli flaw causes crashes, memory corruption, and endless loops.
- Updating Node.js alone is insufficient to secure systems against the HTTP2Shell vulnerability.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache ArrowCyberSecurityNews, 4h ago (the report this story comes from)
- [2]HTTP2Shell Flaw: Critical Brotli Vulnerability ExplainedTech Critter, 2d ago
Background
- [3]Apache Arrow on Wikipedia
- [4]PostgreSQL on Wikipedia
- [5]Apache Arrow on Grokipedia
Our newsroom writes these reports with the help of software, from the 5 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- Brotli decoder memory corruption flaw affects multiple runtimes and software packagesBugs and Patches, 2d ago
- Researchers publish proof of concept exploit for Node js Brotli vulnerabilityBugs and Patches, 3d ago
- CISA warns of critical memory corruption vulnerabilities in EPICS BaseThreat Intelligence, 1h ago
- Terra Security finds sharp rise in broken software patches during 2026Bugs and Patches, 8d ago
- PHP security team issues mitigation for unpatched remote code execution vulnerabilityBugs and Patches, 4d ago
More in Top Stories
- GoAhead Embedded Web Server Patched Following Certificate Revocation Security Flaws1h ago
- Hackers Abuse Microsoft Teams External Chat for Rapid Initial Access1h ago
- OpenAI launches GPT 6 1 Terra model with elevated security flags1h ago
- GMO Internet urges customers to disconnect systems after server breach1h ago
- Hackers infect 953 online stores with malicious loader code1d ago
- Anthropic Files for Public Offering Amid Safety and Hacking Concerns1d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.