Nimendra's Notes 🪴

HTTP2Shell

2 min read

cybersecurity casestudies

Overview

HTTP2Shell is a high-severity memory corruption vulnerability in the Google Brotli decoder that can potentially lead to Remote Code Execution (RCE).
HTTP2Shell is not an HTTP/2 protocol vulnerability. It exploits the software responsible for decompressing malicious Brotli data.

What is Brotli Compression?

HTTP Compression Algorithms

Brotli is a lossless data compression algorithm developed by Google. It makes files and web pages smaller so they can be transferred faster over the internet.

Think of it like ZIP compression, but optimized for web content such as HTML, CSS, JavaScript, and JSON.

  • Reduces bandwidth usage and improves page loading speed.
  • A server can send compressed content with this header:
    • Uses the HTTP header Content-Encoding: br.

The smaller file takes less bandwidth and can load faster. Because compression is lossless, the original data is restored exactly.

Normally, Brotli is safe and useful. However, HTTP2Shell (CVE-2026-111497) exploits a bug in vulnerable Brotli decompressors.

How the Vulnerability Works

  1. An attacker creates a malicious Brotli-compressed payload.
  2. A vulnerable application decompresses the payload.
  3. A decoder bug causes an out-of-bounds memory write.
  4. Memory corruption can result in:
    • Denial of Service (DoS)
    • Information disclosure
    • Potential Remote Code Execution (RCE)

Root Cause: The decoder incorrectly handles a malformed block switch, allowing data to overflow an internal buffer.

Affected Software

  • Google Brotli decoder, Node.js, Python Brotli libraries
  • Other applications embedding vulnerable Brotli versions

HTTP2Shell (CVE-2026-111497) - Attack Flow

flowchart TD
    A["Attacker"] --> B["Crafts malicious Brotli-compressed data"]
    B --> C["HTTP request or response"]
    C --> D["Content-Encoding: br"]
    D --> E["Application decompresses Brotli data"]
    E --> F{"Brotli decoder vulnerable?"}

    F -->|No| G["Safely rejects malformed data"]
    F -->|Yes| H["Invalid block-type switch"]
    H --> I["Out-of-bounds memory write"]
    I --> J["Memory corruption"]

    J --> K["Application crash / DoS"]
    J --> L["Possible information disclosure"]
    J --> M["Potential remote code execution"]

    N["Mitigation: patch Brotli and affected runtimes"] -.-> F

    style A fill:#fce7e7,stroke:#dc2626,color:#991b1b
    style I fill:#fce7e7,stroke:#dc2626,color:#991b1b
    style J fill:#fce7e7,stroke:#dc2626,color:#991b1b
    style G fill:#dcfce7,stroke:#16a34a,color:#166534
    style N fill:#dcfce7,stroke:#16a34a,color:#166534

Mitigation

  • Update Brotli to a patched release, such as 1.2.1.
  • Update Node.js to 22.23.4, 24.22.1, or 26.12.1 on the respective release lines.
  • Update affected dependencies and rebuild containers.
  • Restrict decompression of untrusted Brotli input until patched.

References

Backlinks

Graph View