A vulnerability has been identified in the reference implementation of the Brotli data compression format decoder (CVE-2026-111497, codenamed Broccoli2Shell and HTTP2Shell), leading to a buffer overflow when processing specially crafted compressed data. According to Google, this vulnerability can be exploited for remote code execution attacks on projects using the official Brotli decoder implementation. Affected projects include: Node.js, Bun, Envoy, Istio, web browsers, proxy servers, HTTP clients, HTTP servers, archivers, UEFI firmware, JPEG XL viewers, content decoding libraries for Python, Ruby, Java, PHP, and .NET, along with their associated dependencies.
The issue was discovered by OpenAI in February of this year and has been blocked in the Brotli codebase by discarding invalid streams during decoding. On October 22, patches Brotli 1.0.10, 1.1.1, and 1.2.1 were released explicitly stating the vulnerability had been fixed and the core issue addressed. On the same day, a prototype exploit was created that allowed remote code execution in laboratory settings using non-standard builds (standard builds crashed). Later, Imperva observed an attack on the standard Node.js 24.22.0 builds in a Linux environment on the ARM64 system.
The vulnerability leads to out-of-bounds writes due to improper error handling when parsing blocks in the compressed stream. The DecodeBlockTypeAndLength() function only returned true or false instead of an error code, preventing the calling code from distinguishing between a stream corruption and a state requiring additional data to be passed to the function. When an incorrect block type of compressed data was indicated in the stream, the decoder did not perceive it as an error but rather as a state of insufficient data requiring further reads from the stream. However, since the allocated buffer was not sized for the additionally read data, they were written outside its bounds, where the internal state of the decoder was stored.
Projects vulnerable to the exploit include:
- The reference Brotli library manifests this problem starting from release 1.0.3 and has been fixed in updates 1.0.10, 1.1.1, and 1.2.1. The vulnerability affects applications and libraries using the libbrotlidec library.
- The JavaScript platform Node.js has resolved the issue in updates 26.12.1, 24.22.1, and 22.23.4. Applications that use the fetch() method to request third-party content, which automatically decodes HTTP responses with the header 'Content-Encoding: br', may be vulnerable. The vulnerability is also evident when directly calling the methods zlib.brotliDecompress*(), createBrotliDecompress(), and brotli.decompress() for unpacking third-party content or when receiving HTTP requests parsed through the Express 5 and body-parser 2.x libraries.
- Python packages brotli and brotlicffi (fix suggested in version 1.2.1), along with the projects that use them, including popular libraries urllib3, aiohttp, httpx, and Scrapy, which decode responses with the header 'Content-Encoding: br' when accessing external web resources.
- HTTP servers, HTTP proxies, HTTP clients, and web browsers that support Brotli compression ('Accept-Encoding: br'). Apache httpd includes mod_brotli (which is disabled by default). For nginx, there is a third-party module ngx_brotli (the version of brotli in the dependencies has been updated to the latest). In Chrome/Chromium and Firefox, the issue has already been resolved in previous updates. In the proxy,server Envoy vulnerability has been fixed in releases 1.40.0, 1.39.3, 1.38.6, 1.37.8, and 1.36.12.
- .NET runtime when using the methods BrotliDecoder, BrotliStream, and HttpClient in the application. The vulnerability has not yet been fixed.
- PHP extension brotli when using the function brotli_uncompress(). A fix is in preparation.
- Ruby package brotli when using the method Brotli.inflate. The vulnerability has not yet been fixed.
- Database DuckDB when importing compressed Parquet files. A fix is in preparation.
- Database ClickHouse. A fix is in preparation.
- Database YDB. The vulnerability has not yet been fixed.
- Apache Arrow when importing compressed Parquet files. A fix is in preparation.
- libjxl (Brotli is used for compressing metadata in JPEG XL).
A fix is in preparation. - Archivers NanaZip, 7-Zip-zstd, and p7zip when unpacking br-files. The vulnerability has not been fixed.
- MuPDF. The vulnerability has not been fixed.
- EDK II and UEFITool-based UEFI firmware compressed using Brotli. A fix is in preparation - EDK II and UEFITool.
- JavaScript platform Bun. The vulnerability has been fixed in version 1.4.4.
- Platform for managing microservices Istio. The vulnerability has been fixed in versions 1.29.9, 1.30.6, and 1.31.2.
- curl and libcurl, the vulnerability occurs when there is a vulnerable version of libbrotlidec in dependencies.
- Parsers of the Web Open Font (WOFF) format, which uses
Brotli. - Brotli4j, SumatraPDF, Ghostscript, CatBoost, and YTsaurus. The vulnerability has been fixed in one of the updates.
Source: opennet.ru
