[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFnuu-NVkBOL5wQr1eHDIoVl8NYFJvRztAgCvkhGECqA":3},{"article":4,"iocs":49,"watch_terms":54,"solutions":55,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"014be268-c922-4f69-b922-cc011a9d9ae7","HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow","http2shell-vulnerability-extends-beyond-http-affecting-net-ffmpeg-clickhouse-and-233e0b","The HTTP2Shell vulnerability reaches beyond web traffic, with new research showing how the same Brotli decoder flaw (CVE-2026-111497) can disrupt .NET applications, FFmpeg media processing, ClickHouse servers, and Apache Arrow workloads. The findings show that checking Node.js versions alone can leave other exposed software unnoticed. In research published on October 25, JFrog researchers Aviv Engelberg, […] The post HTTP2Shell Vulnerability Extends Beyond HTTP, Affecting .NET, FFmpeg, ClickHouse, and Apache Arrow appeared first on Cyber Security News.","A Brotli decoder flaw, CVE-2026-111497, known as HTTP2Shell, has been found to affect multiple software stacks beyond web traffic, including .NET applications, FFmpeg, ClickHouse, and Apache Arrow. The vulnerability can lead to crashes, memory corruption, and endless decoding loops, with researchers warning that solely checking Node.js versions may leave other software exposed.","HTTP2Shell vulnerability impacts .NET, FFmpeg, ClickHouse, and Apache Arrow beyond web traffic.","https:\u002F\u002Fcybersecuritynews.com\u002Fhttp2shell-vulnerability\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHTTP2Shell-Vulnerability-Extends-Beyond-HTTP-Affecting-.NET-FFmpeg-ClickHouse-and-Apache-Arrow.webp","2026-10-26T06:35:41+00:00","2026-10-26T07:00:08.600359+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},".NET","product",{"name":21,"type":19},"FFmpeg",{"name":23,"type":19},"ClickHouse",{"name":25,"type":19},"Apache Arrow",{"name":27,"type":19},"Brotli",{"name":29,"type":30},"Google","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50],{"type":51,"value":52,"context":53},"cve","CVE-2026-111497","HTTP2Shell vulnerability",[29,18,21],{"controls":56,"vendors":142},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":48,"name":116,"problem":117,"products":118},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":136,"vendor_name":29,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[143,146,152],{"slug":136,"name":29,"logo_path":137,"roles":144},[145],"affected",{"slug":147,"name":148,"logo_path":149,"roles":150},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png",[151],"reported_by",{"slug":108,"name":109,"logo_path":110,"roles":153},[145],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":166},"brotli-decoder-flaw-spreads-risk-across-multiple-software-ecosystems","Brotli Decoder Flaw Spreads Risk Across Multiple Software Ecosystems","The HTTP2Shell vulnerability (CVE-2026-111497) exposes a critical blind spot: organizations that checked only Node.js versions for this Brotli decoder flaw remained exposed because the same vulnerable component is embedded across .NET, FFmpeg, ClickHouse, and Apache Arrow. This illustrates how a single library flaw can propagate silently through a software supply chain, multiplying attack surface far beyond the originally reported context. Memory corruption and denial-of-service conditions make this particularly dangerous for backend infrastructure and data processing pipelines. The incident underscores that vulnerability management must account for transitive and embedded dependencies, not just top-level applications.",[159,160,161,162,163,164,165],"CIS Control 7: Continuous Vulnerability Management","OWASP A06:2021 Vulnerable and Outdated Components","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":167,"PCI DSS Requirement 6":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"OWASP A06:2021 Vulnerable and Outdated Components":170,"CIS Control 7: Continuous Vulnerability Management":171,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":172,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":173},"NIS2 requires operators of essential services to implement vulnerability handling and disclosure practices that would necessitate tracking and remediating this flaw across the full breadth of affected software ecosystems.","Requirement 6 mandates identifying and protecting systems from known vulnerabilities through patching and component management, directly applicable to ensuring all software using the vulnerable Brotli library is updated.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control would mandate tracking CVE-2026-111497 across all systems using the Brotli decoder, not just Node.js.","This vulnerability is a textbook A06 scenario where a known-vulnerable third-party library propagates risk across multiple software stacks because component inventories were incomplete or not maintained.","Continuous scanning across all software components, including embedded libraries like Brotli, would have identified the exposure in .NET, FFmpeg, and others before attackers could exploit it.","This control requires timely identification and remediation of technical vulnerabilities across all software assets, which would have driven a broader cross-ecosystem search beyond the initially reported Node.js context.","Maintaining an accurate asset and software inventory—a prerequisite under NIST CSF Protect functions—enables organizations to quickly map which systems are exposed when a shared library like Brotli is found vulnerable."]