I feel as though this should be googlebrotli2shell, not http2shell. Google deserves to take a bit of a reputational hit for this. This is a basic memory safety violation, from the same organization that does wuffs, that promotes Rust for memory safety, that has Carbon. zstd has high quality rust implementations and is from roughly the same time.<p>On top of that, the brotli library saw no releases for almost a full year, with the fix for this vulnerability being committed back in February. Google builds from main for all their projects, so were unaffected, but open source releases are a complete afterthought. Over 100 commits with miscellaneous fixes left languishing until a security incident forces a release.
> zstd has high quality rust implementations<p>On the decompression side yes, on the compression side the first good zstd rust port was announced <i>yesterday</i>. Until then, brotli was better supported in Rust than zstd.<p>But I agree, decompression libraries should be (mostly) memory safe nowadays, since that side is both easier to implement and more likely to be vulnerable.
This one again feels overblown, at least for servers. I just checked an org of over 200 GitHub repos. Node, Python, and C#. None of them are vulnerable... because none of them actually call the Brotli decoder. It's just not enabled by default on the server side, by the platforms themselves. This is much like the PHP bugs, where specific conditions have to be in play before you're actually vulnerable.<p>For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.<p>(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)
Doesn't node's fetch call the decoder automatically for `br` responses? So any attacker controlled content that a server fetch's may be vulnerable?
How did you check? Is there are PoC or some kind of command to run?
I mean, I dare say the 4,200,000 Python servers built <i>yesterday alone</i> with this package might disagree...? <a href="https://pypistats.org/packages/brotli" rel="nofollow">https://pypistats.org/packages/brotli</a><p>I can't find download numbers for extras, but it comes in the pretty dang innocuous-seeming `aiohttp[speedups]`, as well. Also `urllib3[brotli]`. Many, many people will be running these servers without recognizing the name of the library, especially in the agentic era.<p>I might be missing something obvious in your message, cause I don't see why server/client is relevant. Why would a frontend app speak a protocol that the backend doesn't?
That's just the total number of times that package was downloaded, which is completely unrelated to how many servers it appears in? Same with `aiohttp`: aiohttp can be used as a client library.<p>Sure, people should check their dependency trees, and make informed decisions.
The whole package manager system is a complete disaster. A huge number of dependencies are pulled in that go unused in most projects, so the number of downloads is an extremely unreliable number. I'd be surprised if more than 10% of those downloads actually use the brotli decoder.
I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
We should start naming them like hurricanes: NIST creates a list of alphabetical names and assigns any CVE >= 9.0 with a name. Vulnerability Alex (CVE 9.4)
CVE scores are already inflated because it looks good for their discoverers.
Vulnerability Zzyzx in a week
"Oh man, Jan really ruined my weekend."<p>I actually kinda like how that works.
that ship sailed a while ago. Rowhammer is the first one I can remember
Let's not forget about heartbleed!
Back in the email days the virus authors named them, e.g. YouAreAnIdiot, ILoveYou
That was the first exploit logo I can recall
Rowhammer was kind of special, surely, what with being based on a physical design flaw?
It looks like brotli <= 1.2.0 is vulnerable.<p>The python package has already been updated to 1.2.1. <a href="https://pypi.org/project/brotli/1.2.1/" rel="nofollow">https://pypi.org/project/brotli/1.2.1/</a>
I feel like normal security issues don't get much publicity. The PHP and eMudhra issues seemed severe, and worth publicity. But then with things like this, I'm not sure. Is this a severe issue? Or is it just a run of the mill issue that's only newsworthy because web security is on people's minds right now?
If your code ever accesses an HTTP URL that server can hack it. Some of the time, clients might be able to hack it too. This is comparable to the PHP issue.
The whole industry is on edge right now, and numbers wise the CVE count has exploded beyond belief. It's probably to take the side of caution, treat everything as important and update everything promptly rather than the old way of doing things where libraries are left months or years out of date until something happens.
Interestingly the commit that fixes this in brotli dates back to February <a href="https://github.com/google/brotli/commit/0ed4268a4401abcb4472096340477cf4af7d1a2b" rel="nofollow">https://github.com/google/brotli/commit/0ed4268a4401abcb4472...</a>
Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.
Apparently it doesn't contain a binding to the C library, but it does contain some compatibility and shares design decisions with it. In other words, it's not a clean-room implementation from the spec, but rather it's a port. Since this RCE is triggered by a OOB access, it's unlikely to have made it into the crate, but it's good to keep these things in mind.
Nope, run ldd on cargo; it links to libbrotlidec.so.1. Via libcurl.<p>Aren't you glad cargo connects to the network whenever it feels like it? I just love it when my build tool does that.<p>There are 753 crates that drag in brotli this way: <a href="https://lib.rs/crates/curl/rev" rel="nofollow">https://lib.rs/crates/curl/rev</a><p>The real killer is the oath crate. Basically every rust project using OAuth is vulnerable. That's 398 projects on crates.io plus who knows how many binaries (a lot of non-library projects don't bother publishing to crates.io).<p>Another scary one is "a practical HTTP client that is fun" <a href="https://lib.rs/crates/isahc" rel="nofollow">https://lib.rs/crates/isahc</a> used in 317 crates including sequoia. In case you wanted somebody to steal your private keys.
There’s apparently no writeup on exactly what was the fix. So I’m going to make a guess that this is the chromium commit that fixed the problem: <a href="https://source.chromium.org/chromium/chromium/src/+/224140d410af003ca0266a3328accaabd24329f9" rel="nofollow">https://source.chromium.org/chromium/chromium/src/+/224140d4...</a><p>And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.<p>Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.
They just keep coming, don't they?
For as long as we still have C code accessible to the internet.
Never gonna stop. Consider it normal. Hey, at least humans still have a job. Incident response
>A significant blast radius<p>Is it really so hard to write a 2 sentence tweet that you need an AI to do it for you?
Likely mitigation: disable brotli (br) content-encoding on both sides
This is a better article: <a href="https://www.aikido.dev/blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497" rel="nofollow">https://www.aikido.dev/blog/python-packages-vulnerable-node2...</a><p>and this is the actual CVE report, which doesn't say much: <a href="https://www.cve.org/CVERecord?id=CVE-2026-111497" rel="nofollow">https://www.cve.org/CVERecord?id=CVE-2026-111497</a>
Is Deno affected, too? It uses brotli by default. But I don’t know how it is implemented.
If you are using Python, you are affected if you use <i>urllib3</i>, <i>requests</i>, <i>httpx</i>, <i>aiohttp</i>, <i>Scapy</i>, and others, if they were installed when Brotli was also installed. You can mitigate by uninstalling brotli and brotlicffi, OR, strip `br` from Accept-Encoding on outbound AND reject `Content-Encoding: br` on inbound.<p>This is not a server-side issue (unless for some weird reason you're using Brotli decoding in your http request processing), it's client-side.<p>Thank you Paul for the write-up (<a href="https://opensourcemalware.com/blog/node2shell-affects-python" rel="nofollow">https://opensourcemalware.com/blog/node2shell-affects-python</a>)
Here's the normal link:<p><a href="https://x.com/AikidoSecurity/status/2113759110625906950" rel="nofollow">https://x.com/AikidoSecurity/status/2113759110625906950</a>
is flask hello world with gunicorn behind apache vulnerable?
Only decompression with Google's brotli library is affected. So if you use "Brotli" or "brotlicffi" in your Python app to decompress brotli, you're vulnerable. Compressing responses with brotli from Apache is safe.
what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected<p>whether a hello wolrd in fastapi is affected might also be interesting
The brotli commit under this is a state fix more than a bounds fix: DecodeBlockTypeAndLength used to return BROTLI_FALSE for both "needs more input" and "format error", so a stream truncated at a block-switch boundary is reported as invalid, and a caller that branches on that can be walked into the wrong path. The commit gives the function a BrotliDecoderErrorCode, adds a distinct BLOCK_SWITCH format error and keeps NEEDS_MORE_INPUT for the truncated case (google/brotli 0ed4268).<p>Worth checking before the panic: node vendors that decoder in deps/brotli, and its v24.x tree already carries the changed function, so 24.x is not exposing the old behaviour. What is exposed is anything still vendoring brotli from before February 2026, and "disable br" is a fine stopgap that leaves the decoder in place.<p>From the honeypot side, an HTTP/1.1-only decoy farm is blind to this class. Mine is: no h2 preface in 7,900 lines, so the sweepers can't tell me whether anybody is already trying it.
[flagged]
> refusing br content-encoding at the edge seems like the fastest mitigation.<p>That's pretty difficult if you make outbound requests, and don't already have a TLS interception proxy set up.
This is an AI karmabot comment, it should remain flagged
Another day, another buffer-overflow vulnerability in C code …
Brotli, another one of those pseudostandards[1] from Big G that I was avoiding all along. Dodged another bullet.<p>[1] When more than half of the "standard" <a href="https://www.rfc-editor.org/info/rfc7932/#page-44" rel="nofollow">https://www.rfc-editor.org/info/rfc7932/#page-44</a> is an opaque binary blob, they're really not encouraging independent implementations.<p>Edit: the votes really show what an echochamber for Big G this place has become. FUCK YOU, GOOGLE!
<a href="https://x.com/AikidoSecurity/status/2113759110625906950" rel="nofollow">https://x.com/AikidoSecurity/status/2113759110625906950</a>