Brotli CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse, and Arrow
Original title: HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow
JFrog showed crashes, memory corruption, and an endless loop; a full FFmpeg remote code execution exploit was not shown.
JFrog researchers traced CVE-2026-111497, a Google Brotli decoder flaw first patched in Node.js on October 21, into other stacks. Crafted input caused memory corruption and a crash in FFmpeg via libjxl, a native crash through .NET Brotli APIs, and a ClickHouse crash from one 23 MB request. Apache Arrow’s pyarrow path entered an endless loop on a 534-byte input. Microsoft said on October 25 it was rolling out runtime and SDK updates; ClickHouse’s fix was merged but not released, and Arrow’s issue remained open.
Unconfirmed: JFrog did not establish remote code execution for FFmpeg, and ClickHouse and Arrow fixes were not shipped at publication.
- Affected Brotli ranges are 1.0.3 before 1.0.10, 1.1.0 before 1.1.1, and 1.2.0 before 1.2.1.
- Node.js fixes are in 22.23.4, 24.22.1, and 26.12.1, according to Sysdig.
- FFmpeg testing showed pointer corruption but not a complete remote code execution exploit.
- ClickHouse had no patched release when the research appeared.
Impact: Crashes, memory corruption, or CPU-consuming decode loops
| Product | Affected | Fixed in |
|---|---|---|
| Google Brotli | 1.0.3 before 1.0.10; 1.1.0 before 1.1.1; 1.2.0 before 1.2.1 | 1.0.10, 1.1.1, and 1.2.1 |
| Node.js | — | 22.23.4, 24.22.1, and 26.12.1 |
| Microsoft .NET | supported runtimes and SDKs | — |
| FFmpeg | — | — |
| ClickHouse | — | — |
| Apache Arrow | — | — |
- 1.Update Node.js to 22.23.4, 24.22.1, or 26.12.1 on those lines.
- 2.Apply Microsoft’s October 25 runtime and SDK updates.
- 3.Check vendor patch records instead of Brotli version numbers alone.
- CVEs
- CVE-2026-111497
- Organizations
- JFrogSysdig Threat Research Team
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
From the original article
2 min read at cybersecuritynews.com
The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt . NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. The findings show that checking Node.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.