Rendered at 04:04:50 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
mirashii 2 minutes ago [-]
I feel as though this should be googlebrotli2shell, not http2shell. Google deserves to take a bit of a reputational hit for this. This is a basic memory safety violation, from the same organization that does wuffs, that promotes Rust for memory safety, that has Carbon. zstd has high quality rust implementations and is from roughly the same time.
On top of that, the brotli library saw no releases for almost a full year, with the fix for this vulnerability being committed back in February. Google builds from main for all their projects, so were unaffected, but open source releases are a complete afterthought. Over 100 commits with miscellaneous fixes left languishing until a security incident forces a release.
ataraxia937 2 hours ago [-]
This one again feels overblown, at least for servers. I just checked an org of over 200 GitHub repos. Node, Python, and C#. None of them are vulnerable... because none of them actually call the Brotli decoder. It's just not enabled by default on the server side, by the platforms themselves. This is much like the PHP bugs, where specific conditions have to be in play before you're actually vulnerable.
For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.
(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)
guac 39 minutes ago [-]
Doesn't node's fetch call the decoder automatically for `br` responses? So any attacker controlled content that a server fetch's may be vulnerable?
babuskov 1 hours ago [-]
How did you check? Is there are PoC or some kind of command to run?
I can't find download numbers for extras, but it comes in the pretty dang innocuous-seeming `aiohttp[speedups]`, as well. Also `urllib3[brotli]`. Many, many people will be running these servers without recognizing the name of the library, especially in the agentic era.
I might be missing something obvious in your message, cause I don't see why server/client is relevant. Why would a frontend app speak a protocol that the backend doesn't?
deathanatos 2 hours ago [-]
That's just the total number of times that package was downloaded, which is completely unrelated to how many servers it appears in? Same with `aiohttp`: aiohttp can be used as a client library.
Sure, people should check their dependency trees, and make informed decisions.
2 hours ago [-]
vinyl7 58 minutes ago [-]
The whole package manager system is a complete disaster. A huge number of dependencies are pulled in that go unused in most projects, so the number of downloads is an extremely unreliable number. I'd be surprised if more than 10% of those downloads actually use the brotli decoder.
anonymous908213 3 hours ago [-]
I could do without every memory bug getting a cute sensational name and marketing push, I have to say.
aaronbrethorst 1 hours ago [-]
We should start naming them like hurricanes: NIST creates a list of alphabetical names and assigns any CVE >= 9.0 with a name. Vulnerability Alex (CVE 9.4)
ks2048 1 hours ago [-]
Vulnerability Zzyzx in a week
nevir 37 minutes ago [-]
Tomorrow
lovich 3 hours ago [-]
that ship sailed a while ago. Rowhammer is the first one I can remember
vinkelhake 3 hours ago [-]
Let's not forget about heartbleed!
judge2020 3 hours ago [-]
Back in the email days the virus authors named them, e.g. YouAreAnIdiot, ILoveYou
Waterluvian 2 hours ago [-]
The Blaster virus was a fun one.
mhio 3 hours ago [-]
That was the first exploit logo I can recall
weinzierl 2 hours ago [-]
The most memorable one for me is DirtyCOW.
card_zero 31 minutes ago [-]
Rowhammer was kind of special, surely, what with being based on a physical design flaw?
Another day another out of bounds access in C code.
ks2048 1 hours ago [-]
Can someone point the heart of this fix? I see a bunch of change of naming of constants, etc
red75prime 35 minutes ago [-]
As far as I understand it's line 1978: `goto saveStateAndReturn;`. Early return that prevents further processing.
hatthew 2 hours ago [-]
I feel like normal security issues don't get much publicity. The PHP and eMudhra issues seemed severe, and worth publicity. But then with things like this, I'm not sure. Is this a severe issue? Or is it just a run of the mill issue that's only newsworthy because web security is on people's minds right now?
Gigachad 2 hours ago [-]
The whole industry is on edge right now, and numbers wise the CVE count has exploded beyond belief. It's probably to take the side of caution, treat everything as important and update everything promptly rather than the old way of doing things where libraries are left months or years out of date until something happens.
And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.
Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.
Until their agent realised there was a good chance of a press release in it.
robswc 52 minutes ago [-]
I am just amazed at how many people are blind to this.
Every single time one of these labs does something it is almost always sensationalized. They absolutely cannot refrain from describing how incredible their models are, it has to be injected into everything. I get this is basic grow-your-company stuff but it is getting obnoxious.
SV_BubbleTime 2 hours ago [-]
Chat, we need to constantly be justifying our absolutely absurd IPO. Use UltraMegThink and reference the ExploitToGetUsRegualtoryCapture.md. kkthnx
Sytten 4 hours ago [-]
Since I checked Rust servers should be fine since the brotli crate is not a binding on the C.
doodlesdev 1 hours ago [-]
Apparently it doesn't contain a binding to the C library, but it does contain some compatibility and shares design decisions with it. In other words, it's not a clean-room implementation from the spec, but rather it's a port. Since this RCE is triggered by a OOB access, it's unlikely to have made it into the crate, but it's good to keep these things in mind.
octoberfranklin 25 minutes ago [-]
Nope, run ldd on cargo; it links to libbrotlidec.so.1. Via libcurl.
Aren't you glad cargo connects to the network whenever it feels like it? I just love it when my build tool does that.
The real killer is the oath crate. Basically every rust project using OAuth is vulnerable. That's 398 projects on crates.io plus who knows how many binaries (a lot of non-library projects don't bother publishing to crates.io).
Another scary one is "a practical HTTP client that is fun" https://lib.rs/crates/isahc used in 317 crates including sequoia. In case you wanted somebody to steal your private keys.
kylepomykala 3 hours ago [-]
They just keep coming, don't they?
Gigachad 2 hours ago [-]
For as long as we still have C code accessible to the internet.
hoppp 2 hours ago [-]
Never gonna stop. Consider it normal. Hey, at least humans still have a job. Incident response
awakeasleep 2 hours ago [-]
Let's not kid ourselves, llm's are already doing the incident response for this in many infrastructure teams
chelmzy 1 hours ago [-]
I would love to hear your definition of this. Are llms used to aid in incident response? 100%. Why would I sit there and manually review data from multiple sources when I could have an agent pull from all and summarize? But to hand it off end to end? I haven't seen anyone accomplish this.
hoppp 2 hours ago [-]
But they don't respond with fear and flailing arms!
1 hours ago [-]
cowlevel 5 hours ago [-]
Likely mitigation: disable brotli (br) content-encoding on both sides
thayne 3 hours ago [-]
Unfortunately, AFAICT, there is no way to do this for node's fetch. I suspect there are other client libraries that don't have a way to disable it.
csiegert 2 hours ago [-]
Is Deno affected, too? It uses brotli by default. But I don’t know how it is implemented.
gnabgib 2 hours ago [-]
Deno is dead (baby)
> We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development
I know that it is dead but since they provide security updates for another year I haven’t migrated off of it immediately. Anyways, the Deno runtime uses a brotli Rust crate that does not wrap C code, and with unsafe off, so I assume it is safe.
gnabgib 1 hours ago [-]
So a person of rhetorical questions? Great
csiegert 55 minutes ago [-]
No. After your unhelpful answer I started investigating if my deployment is affected.
Amsozzer 1 hours ago [-]
I doubt it
VladVladikoff 51 minutes ago [-]
>A significant blast radius
Is it really so hard to write a 2 sentence tweet that you need an AI to do it for you?
0xbadcafebee 27 minutes ago [-]
If you are using Python, you are affected if you use urllib3, requests, httpx, aiohttp, Scapy, and others, if they were installed when Brotli was also installed. You can mitigate by uninstalling brotli and brotlicffi, OR, strip `br` from Accept-Encoding on outbound AND reject `Content-Encoding: br` on inbound.
This is not a server-side issue (unless for some weird reason you're using Brotli decoding in your http request processing), it's client-side.
is flask hello world with gunicorn behind apache vulnerable?
cpburns2009 2 hours ago [-]
Only decompression with Google's brotli library is affected. So if you use "Brotli" or "brotlicffi" in your Python app to decompress brotli, you're vulnerable. Compressing responses with brotli from Apache is safe.
TZubiri 3 hours ago [-]
what I can say is that a 5 liner hello world starting with ‘import socket’ is not affected
whether a hello wolrd in fastapi is affected might also be interesting
bogomind 4 hours ago [-]
[flagged]
bibekadhikari 3 hours ago [-]
[flagged]
thayne 2 hours ago [-]
> refusing br content-encoding at the edge seems like the fastest mitigation.
That's pretty difficult if you make outbound requests, and don't already have a TLS interception proxy set up.
cowlevel 2 hours ago [-]
This is an AI karmabot comment, it should remain flagged
DogeGode 3 hours ago [-]
Another day, another buffer-overflow vulnerability in C code …
On top of that, the brotli library saw no releases for almost a full year, with the fix for this vulnerability being committed back in February. Google builds from main for all their projects, so were unaffected, but open source releases are a complete afterthought. Over 100 commits with miscellaneous fixes left languishing until a security incident forces a release.
For clients? Sure, that's a bigger risk. Patch them. But bad guys aren't attacking your clients unless the clients connect to them. Don't stay up late to fix this.
(And yes, .NET is included here, because Microsoft's Brotli module is a binding for Google's vulnerable reference implementation.)
I can't find download numbers for extras, but it comes in the pretty dang innocuous-seeming `aiohttp[speedups]`, as well. Also `urllib3[brotli]`. Many, many people will be running these servers without recognizing the name of the library, especially in the agentic era.
I might be missing something obvious in your message, cause I don't see why server/client is relevant. Why would a frontend app speak a protocol that the backend doesn't?
Sure, people should check their dependency trees, and make informed decisions.
The python package has already been updated to 1.2.1. https://pypi.org/project/brotli/1.2.1/
Another day another out of bounds access in C code.
And this commit contained a refactoring from BROTLI_BOOL to BrotliDecoderErrorCode so the situation was that probably one of the error conditions previously simply returned false but needed more detail about what went wrong to continue safely.
Well okay this change from `if (prev_ix < cur_ix)` to `if (prev_ix < cur_ix && cached_backward <= max_backward)` is also suspicious and could be an related or unrelated hardening fix.
https://nitter.jaydenha.uk/OpenAI/status/2113766354386084338
Every single time one of these labs does something it is almost always sensationalized. They absolutely cannot refrain from describing how incredible their models are, it has to be injected into everything. I get this is basic grow-your-company stuff but it is getting obnoxious.
Aren't you glad cargo connects to the network whenever it feels like it? I just love it when my build tool does that.
There are 753 crates that drag in brotli this way: https://lib.rs/crates/curl/rev
The real killer is the oath crate. Basically every rust project using OAuth is vulnerable. That's 398 projects on crates.io plus who knows how many binaries (a lot of non-library projects don't bother publishing to crates.io).
Another scary one is "a practical HTTP client that is fun" https://lib.rs/crates/isahc used in 317 crates including sequoia. In case you wanted somebody to steal your private keys.
> We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development
https://deno.com/blog/cloudflare
Is it really so hard to write a 2 sentence tweet that you need an AI to do it for you?
This is not a server-side issue (unless for some weird reason you're using Brotli decoding in your http request processing), it's client-side.
Thank you Paul for the write-up (https://opensourcemalware.com/blog/node2shell-affects-python)
and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497
https://x.com/AikidoSecurity/status/2113759110625906950
whether a hello wolrd in fastapi is affected might also be interesting
That's pretty difficult if you make outbound requests, and don't already have a TLS interception proxy set up.
https://news.ycombinator.com/item?id=50069499
Edit: why flagged
Rust Derangement Syndrome is at epidemic levels here.
[1] When more than half of the "standard" https://www.rfc-editor.org/info/rfc7932/#page-44 is an opaque binary blob, they're really not encouraging independent implementations.
Edit: the votes really show what an echochamber for Big G this place has become. FUCK YOU, GOOGLE!