Brotli2Shell: CVE-2026-111497 reaches .NET, FFmpeg, ClickHouse and Arrow

What happened

Last week, Node2Shell put a Brotli bug on every Node.js team's radar. The bug is CVE-2026-111497. It is an out-of-bounds write in Google's Brotli decoder.

The decoder is the real problem, not Node.js. Any software that ships an old copy may inherit it.

On October 25, 2026, JFrog Security Research made that concrete. Its post, "Brotli2Shell", shows the same flaw in four more places:

• .NET, through its built-in Brotli APIs.
• FFmpeg, through JPEG XL images and libjxl.
• ClickHouse, through HTTP request bodies.
• Apache Arrow, through Parquet and buffer decompression.

The same day, Microsoft shipped out-of-band .NET security updates for the CVE.

This is the same CVE. There is no new identifier. We publish one day after JFrog and Microsoft, on October 26.

Who is affected

.NET. Microsoft lists .NET 8, 9, 10 and the 11 previews. Its advisory scores the flaw CVSS 3.1 8.1 (High). .NET Framework is not affected.

Microsoft is precise about exposure. Having .NET installed is not enough. Your app is exposed only if it decompresses attacker-controlled Brotli data in one of three ways:

• ASP.NET Core request decompression with Brotli enabled.
• HttpClient automatic decompression that includes Brotli.
• Direct use of the Brotli APIs, such as BrotliStream or BrotliDecoder.

The first two are off by default.

FFmpeg. FFmpeg uses libjxl to decode JPEG XL images. libjxl uses Brotli to unpack some metadata boxes. So a crafted image file can reach the decoder. No HTTP is needed.

ClickHouse. Servers that accept request bodies with Brotli content encoding. ClickHouse's own fix note also names .br files and Parquet input.

Apache Arrow. Builds that use Arrow's bundled Brotli, which is pinned to 1.0.9. That includes the pyarrow package, per JFrog. Reading a crafted Parquet or IPC file can trigger the bug. Builds linked to a patched system Brotli are not affected, per the Arrow issue.

What is confirmed

• .NET fix. Microsoft released 8.0.33, 9.0.22, 10.0.14 and 11.0 RC3 on October 25. Its advisory says the flaw may let an unauthenticated attacker read or corrupt process memory. It lists information disclosure, denial of service and elevation of privilege.
• .NET crash. JFrog crashed a local .NET console app with a native segfault. It notes that such a crash kills the whole process, unlike a managed exception.
• FFmpeg. JFrog built a crafted JPEG XL file that corrupts memory in FFmpeg. It controlled the crashing pointer value. That is instruction-pointer control in a lab, not a working exploit.
• ClickHouse. JFrog crashed a test server with one HTTP request. The process died with a segfault, taking in-flight queries with it.
• ClickHouse fix. PR #127419 moves Brotli to 1.2.1. It was merged on October 25. Backports are labelled for the 26.10, 26.9, 26.8 and 26.3 lines.
• Arrow. A small crafted input sent the decoder into an infinite loop. The process burns CPU and never finishes. Brotli 1.2.1 rejects the same input in under a second.
• Score. The CVE issuer, Google, keeps its CVSS 4.0 9.2 score. Microsoft rates its own .NET exposure lower.
• CISA KEV. Not listed (catalog 2026.10.23). CISA's coordinator entry still says "exploitation: none". NVD has not finished its analysis.

What is not confirmed

• RCE outside Node.js. We found no public code execution against .NET, FFmpeg, ClickHouse or Arrow. JFrog says RCE in FFmpeg would need more work and depends on the build. Microsoft does not list RCE for .NET.
• The main RCE demo is still Node.js. Imperva's Node2Shell lab, on one Node.js build, remains the public reference.
• ClickHouse release. When we checked on October 26, no ClickHouse release with the fix was out on GitHub. The latest stable build predates the merge. Watch for the backport releases.
• Arrow fix. Issue #55166 was still open, with no linked fix, when we checked.
• FFmpeg and libjxl fixes. We found no FFmpeg or libjxl advisory yet. The fix will likely come through your libjxl or Brotli package. Check your distribution.
• Exploitation in the wild. None reported.

What to do

1. Patch .NET. Move to 8.0.33, 9.0.22, 10.0.14 or 11.0 RC3. Restart apps after a runtime update.
2. Rebuild what carries its own runtime. Self-contained apps, containers and NativeAOT binaries keep the old decoder until you republish them.
3. Check .NET exposure. Search your code for Brotli request decompression, Brotli in HttpClient settings and direct BrotliStream use. Microsoft says not to add decompression settings you do not already use.
4. Treat untrusted images as input. If you run FFmpeg on uploads, update libjxl and Brotli packages. Consider turning off JPEG XL decoding until you can.
5. Protect ClickHouse. Upgrade as soon as a fixed release ships. Until then, do not expose the HTTP interface to untrusted clients.
6. Watch Arrow jobs. Do not read untrusted Parquet with bundled-Brotli builds. Set timeouts on data jobs so a hang cannot stall a pipeline.
7. Look beyond version lists. Brotli often hides inside other libraries. Scan images and binaries, not only lock files. JFrog and Trail of Bits both publish open-source scanners.

Related coverage

Our Node2Shell story covers the Node.js fixes, Bun, Envoy, Istio and the Python packages.

Record: CVE-2026-111497. Browse the CVE tracker.

Sources: JFrog Security Research, the .NET blog and Microsoft's advisory, ClickHouse PR #127419, Apache Arrow issue #55166, Node.js, Google Brotli, CVE.org, NVD and the CISA KEV catalog. Links are in the references list.