HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow

Recent reports from outlets including SecurityWeek, The Hacker News, Aikido Security, wiz.io, and CyberSecurityNews detail an expanding software security crisis centered around a critical Brotli decoder vulnerability. Initially tracked in relation to Node.js and referred to under names such as Node2Shell and Broccoli2shell, the issue has now evolved into what is being called HTTP2Shell. Coverage indicates that this flaw triggers urgent patching requirements across multiple major technology providers and ecosystems, including Microsoft, Python packages, Bun, and various other widely used software components. According to the provided coverage, the vulnerability is officially tracked under the identifier CVE-2026-111497.

Outlets emphasize that the problem is no longer confined to specific initial parameters. Instead, the scope of the flaw has widened significantly beyond HTTP to impact .NET, FFmpeg, ClickHouse, and Apache Arrow. The reporting highlights the extensive reach of the vulnerability, demonstrating how deeply a single foundational decoder flaw can penetrate diverse development environments, libraries, and enterprise applications. The background established by the coverage shows that the issue stems directly from flaws within the Brotli decompression handling utilized across multiple platforms.

Because Brotli compression is pervasive in modern web infrastructure and software distribution, a decoder vulnerability of this nature creates a broad attack surface. Outlets such as Aikido Security and wiz.io have published specific guides and analyses tracking the evolution from the initial Node.js remote code execution vector to the broader HTTP2Shell designation. As the situation develops, readers and security professionals must monitor ongoing advisories from the affected organizations and maintain vigilance regarding updates for .NET, FFmpeg, ClickHouse, Apache Arrow, and related ecosystems. Coverage does not yet specify the full extent of downstream exploitation or the complete timeline for all required patches, leaving stakeholders to rely on continuous updates from the reporting security outlets.