A Brotli compressed data decoding reference library has a vulnerability (CVE-2026-111497, codenamed Broccoli2Shell and HTTP2Shell) that leads to a buffer overflow when processing specially crafted compressed data. According to Google, this vulnerability can be exploited for remote code execution against projects using the official Brotli decoder implementation. The affected projects include: Node.js, Bun, Envoy, Istio, web browsers, proxy servers, HTTP clients, HTTP servers, archivers, UEFI firmware, JPEG XL viewers, content decoding libraries for Python, Ruby, Java, PHP, and .NET, along with related dependencies.
The issue was discovered by OpenAI in February this year and was addressed in the Brotli codebase by dropping invalid streams during decoding. On October 22, corrective releases of Brotli 1.0.10, 1.1.1, and 1.2.1 were published, explicitly stating that the vulnerability had been resolved and the root issue had been fixed. On the same day, a prototype exploit was created that allowed remote code execution in laboratory conditions when using non-standard builds (standard builds crashed). Later, Imperva documented an attack on the standard build of Node.js 24.22.0 in a Linux environment on an ARM64 system.
The vulnerability leads to a buffer overflow due to improper error handling during the parsing of blocks in the compressed stream. The DecodeBlockTypeAndLength() function returned only true and false instead of an error code, making it impossible for the calling code to distinguish between a stream damage and a state that required additional data to be passed to the function. If an incorrect block type is specified in the compressed data stream, the decoder interpreted it not as an error but as a state of insufficient data requiring further reading from the stream. However, since the allocated buffer was not designed for the additionally read data, they were written outside its limits, where the internal state of the decoder was stored.
Projects vulnerable to exploitation:
- The reference Brotli library has this issue starting from release 1.0.3 and has been fixed in updates 1.0.10, 1.1.1, and 1.2.1. The vulnerability affects applications and libraries utilizing the libbrotlidec library.
- A JavaScript platform Node.js, the problem has been fixed in releases 26.12.1, 24.22.1, and 22.23.4. Applications that use the fetch() method to request third-party content, which automatically decodes HTTP responses with the header 'Content-Encoding: br' may be vulnerable. The vulnerability also manifests when directly calling the methods zlib.brotliDecompress*(), createBrotliDecompress(), and brotli.decompress() for unpacking third-party content or when receiving HTTP requests parsed through Express 5 and body-parser 2.x libraries.
- Python packages brotli and brotlicffi (the fix was proposed in version 1.2.1) and the projects using them, including popular libraries such as urllib3, aiohttp, httpx, and Scrapy, which decode responses with the header 'Content-Encoding: br' when accessing external web resources.
- HTTP servers, HTTP proxies, HTTP clients, and web browsers that support Brotli compression ('Accept-Encoding: br'). Apache httpd comes with mod_brotli (disabled by default). A third-party module ngx_brotli is available for nginx (the brotli version in dependencies has been updated to current). In Chrome/Chromium and Firefox, the issue has already been fixed in a past update. In the proxy -szerveren Envoy, the vulnerability has been fixed in releases 1.40.0, 1.39.3, 1.38.6, 1.37.8, and 1.36.12.
- .NET runtime when using the methods BrotliDecoder, BrotliStream, and HttpClient in the application. The vulnerability has not yet been fixed.
- PHP extension brotli when using the function brotli_uncompress(). A fix is in preparation.
- Ruby package brotli when using the method Brotli.inflate. The vulnerability has not yet been fixed.
- Database DuckDB when importing compressed Parquet files. A fix is in preparation.
- Database ClickHouse. A fix is in preparation.
- Database YDB. The vulnerability has not yet been fixed.
- Apache Arrow when importing compressed Parquet files. A fix is in preparation.
- libjxl (Brotli is used for compressing metadata in JPEG XL).
A fix is in preparation. - Archivers NanaZip, 7-Zip-zstd, and p7zip when unpacking br files. The vulnerability has not yet been fixed.
- MuPDF. The vulnerability has not yet been fixed.
- UEFI firmware based on EDK II and UEFITool, compressed using Brotli. A fix is in preparation - EDK II and UEFITool.
- JavaScript platform Bun. The vulnerability has been fixed in version 1.4.4.
- Platform for managing microservices Istio. The vulnerability has been fixed in versions 1.29.9, 1.30.6, and 1.31.2.
- curl and libcurl, the vulnerability manifests when the vulnerable version of libbrotlidec is present in dependencies.
- Parsers of the Web Open Font (WOFF) font format, which uses
Brotli. - Brotli4j, SumatraPDF, Ghostscript, CatBoost és YTsaurus. A sebezhetőséget egy frissítés során megszüntették.
Forrás: opennet.ru
