VulnerabilitiesOct 26, 2026

HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow

HTTP2Shell vulnerability impacts .NET, FFmpeg, ClickHouse, and Apache Arrow beyond web traffic.

A Brotli decoder flaw, CVE-2026-111497, known as HTTP2Shell, has been found to affect multiple software stacks beyond web traffic, including .NET applications, FFmpeg, ClickHouse, and Apache Arrow. The vulnerability can lead to crashes, memory corruption, and endless decoding loops, with researchers warning that solely checking Node.js versions may leave other software exposed.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Google?

Get an email when a new story names Google, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

The HTTP2Shell vulnerability (CVE-2026-111497) exposes a critical blind spot: organizations that checked only Node.js versions for this Brotli decoder flaw remained exposed because the same vulnerable component is embedded across .NET, FFmpeg, ClickHouse, and Apache Arrow. This illustrates how a single library flaw can propagate silently through a software supply chain, multiplying attack surface far beyond the originally reported context. Memory corruption and denial-of-service conditions make this particularly dangerous for backend infrastructure and data processing pipelines. The incident underscores that vulnerability management must account for transitive and embedded dependencies, not just top-level applications.

What helps against this

How we list vendors

Google affected JFrog research Microsoft affected

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleQualys VMDR Tenable Vulnerability Management Axonius Exposures all options
Automated patch management
Known holes get closed in days, not months.
For exampleManageEngine Patch Manager Plus NinjaOne Patch Management Microsoft Intune all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleCrowdStrike Falcon Adversary Intelligence Dataminr Agentic Threat Intelligence Platform Google Threat Intelligence all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-111497

Entities

.NET (product)FFmpeg (product)ClickHouse (product)Apache Arrow (product)Brotli (product)Google (vendor)