Threat reportVulnerabilityTL-2026-4315
Python2Shell: Brotli decoder out-of-bounds write in PyPI Brotli/brotlicffi (CVE-2026-111497)
Python2Shell (TL-2026-4315), also tracked as Python2Shell, is a critical-severity software vulnerability scored CVSS 9.2, first published 2026-10-23. It has no confirmed attribution, affects Google / PyPI Brotli (PyPI), references 1 CVE (CVE-2026-111497), maps to 4 MITRE ATT&CK techniques (T1059, T1190, T1203), and is covered by 9 detection rules and 12 indicators of compromise.
- CVSS
- 9.2/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4315
- Threat ID
- TL-2026-4315
- Also known as
- Python2Shell, Node2Shell
- Severity
- CRITICAL
- CVSS
- 9.2 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, cloud services, web services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Python2Shell
Malware and tooling: Python, httpclient - S0068
How Python2Shell works
A memory-safety flaw in the Brotli C decoder's DecodeBlockTypeAndLength() conflates 'malformed stream' with 'need more input', letting a crafted Brotli stream drive out-of-bounds writes. Python apps using urllib3/requests, httpx, aiohttp or Scrapy are exposed whenever Brotli or brotlicffi is installed, even without explicit Brotli imports. Fixed in Brotli 1.2.1 and brotlicffi 1.2.1.0; no in-the-wild exploitation reported.
CVE-2026-111497 (nicknamed Node2Shell for Node.js and Python2Shell for the Python packages) is an unchecked-return-value (CWE-252) bug leading to an out-of-bounds write (CWE-787) in Google's Brotli decoder (c/dec/decode.c). DecodeBlockTypeAndLength() returns a plain BROTLI_BOOL, so BROTLI_FALSE can mean either 'this stream is malformed' or 'I need more input'. Block-switch callers treated the result as recoverable, and the fast decode path discarded it entirely, so decoding continued with invalid internal state and wrote past the ring buffer. The CVE record places the bug in Brotli 1.0.3 through 1.2.0 (fixed in 1.0.10, 1.1.1 and 1.2.1). The upstream fix makes the function return an error code and adds BROTLI_DECODER_ERROR_FORMAT_BLOCK_SWITCH (-17).
In the Python ecosystem the PyPI packages Brotli (<=1.2.0) and brotlicffi (<=1.2.0.x) bundle the vulnerable decoder. Aikido and OpenSourceMalware report that HTTP clients automatically decode Brotli responses when these packages are installed: urllib3/requests, httpx (brotli extra), aiohttp and Scrapy. Any service that fetches attacker-influenced URLs (webhooks, URL previews, crawlers, proxies) can therefore receive a malicious Content-Encoding: br response, and frameworks that accept Content-Encoding: br request bodies are reachable inbound. OpenSourceMalware testing showed that crafted streams made vulnerable 1.2.0 decoders report NEEDS_MORE_INPUT on complete payloads, while patched versions return ERROR -17 FORMAT_BLOCK_SWITCH. Brotli on PyPI has roughly 82.8 million monthly downloads. Neither package's release notes mention the vulnerability, and as of 2026-10-23 pip-audit, Dependabot and Safety did not yet flag the affected versions.
Impact ranges from process crashes and memory disclosure to potential remote code execution in the process context. Public exploitation work so far targets Node.js: Imperva published a working RCE PoC (Node.js 24.22.0 on Linux arm64, via fetch() responses and Express 5.0.0-5.3.0 / body-parser 2.0.0-2.3.0 request bodies; reliability required multiple attempts), and Vercel reports researchers achieved memory disclosure and command execution. No public PoC specific to the Python packages and no in-the-wild exploitation or attribution were reported in the sources reviewed. Node.js shipped fixes (22.23.4, 24.22.1, 26.12.1) on 2026-10-21; Brotli 1.2.1 reached PyPI on 2026-10-22 and brotlicffi 1.2.1.0 on 2026-10-23.
MITRE ATT&CK techniques used in TL-2026-4315
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1190 Exploit Public-Facing Application
Impact
Affected products and versions in Python2Shell
- Google / PyPI — Brotli (PyPI)
Vulnerable versions: >=1.0.3, <1.2.1
Fixed in: 1.2.1 - PyPI — brotlicffi
Vulnerable versions: >=1.0.3, <1.2.1.0 (<=1.2.0.x)
Fixed in: 1.2.1.0 - Python ecosystem — urllib3, requests, httpx, aiohttp, Scrapy (exposed when Brotli/brotlicffi is installed)
Vulnerable versions: Any version with a vulnerable Brotli/brotlicffi installed
Fixed in: Same versions with Brotli>=1.2.1 / brotlicffi>=1.2.1.0 - OpenJS Foundation — Node.js (related Node2Shell flaw)
Vulnerable versions: 22.x < 22.23.4; 24.x < 24.22.1; 26.x < 26.12.1
Fixed in: 22.23.4; 24.22.1; 26.12.1
Remediation for Python2Shell
Patches
- Brotli 1.2.1 (PyPI)
- brotlicffi 1.2.1.0 (PyPI)
- Upstream google/brotli fix commits 0ed4268, 50a9b70, b418fa8, da98063 (releases v1.0.10, v1.1.1, v1.2.1)
- Node.js 22.23.4, 24.22.1, 26.12.1 for the related Node2Shell flaw
Immediate actions
- Upgrade with: pip install -U "Brotli>=1.2.1" "brotlicffi>=1.2.1.0"
- Inventory environments (including container images and lockfiles) that install Brotli or brotlicffi, directly or via requests[brotli]/httpx[brotli]/urllib3[brotli]
- Reject Content-Encoding: br on inbound requests at the proxy/WAF layer where Brotli request bodies are not required
Workarounds
- Uninstall Brotli and brotlicffi if Brotli decoding is not needed
- Strip br from outbound Accept-Encoding headers so clients do not receive Brotli responses
- Reject Content-Encoding: br at the infrastructure layer
Longer-term hardening
- Track advisory GHSA-9v8h-qqgm-4m35 and re-run pip-audit/Dependabot/Safety once the CVE is mapped to PyPI packages
- Treat decompression of untrusted network input as a security boundary and monitor workers for unexpected crashes or segfaults
- Pin and rebuild base images and lockfiles so patched Brotli versions propagate to all services
CVEs associated with Python2Shell
Weaknesses (CWE) in Python2Shell
Timeline of Python2Shell
- Fix committed to the google/brotli repository (reported as February 2026; commits 0ed4268, 50a9b70, b418fa8, da98063).
- Node.js releases 22.23.4, 24.22.1 and 26.12.1 fixing CVE-2026-111497 (Node2Shell) alongside nine other vulnerabilities; Brotli v1.0.10, v1.1.1 and v1.2.1 released.
- Brotli 1.2.1 published to PyPI; GitHub advisory GHSA-9v8h-qqgm-4m35 published. Release notes do not mention the vulnerability.
- Aikido Security and OpenSourceMalware publish that Python packages Brotli and brotlicffi are also vulnerable (Python2Shell); pip-audit, Dependabot and Safety do not yet flag affected versions.
- Imperva publishes analysis and a working RCE proof of concept for the Node.js variant (Node.js 24.22.0, Linux arm64); no in-the-wild exploitation reported.
- brotlicffi 1.2.1.0 released to PyPI; GHSA reviewed and updated.
Sources cited for Python2Shell
- Python packages are also vulnerable to the Node2Shell Brotli flaw (CVE-2026-111497) - Aikido
- Python Packages Vulnerable to Node2Shell - OpenSourceMalware
- GitHub Advisory GHSA-9v8h-qqgm-4m35
- Node2Shell: From Brotli Data to Remote Code Execution - Imperva
- Node.js Brotli Decoder Out-of-Bounds Write (RCE) - OX Security
- Node.js security advisory: Brotli decoder RCE (CVE-2026-111497) - Vercel
- Node2Shell: Node.js Brotli Flaw Gets RCE Proof of Concept - Cyber Kendra
- Node2Shell: Fixed Node.js Versions and Check - Brandefense
Detection coverage for TL-2026-4315
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4315 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.