Repository navigation
Conversation
The Go Brotli port of HTTP2Shell panics on untrusted Content-Encoding: br and on TLS cert compression via utls. v1.2.7 is the fixed decoder. Also bound gzip/deflate/brotli inflate so ReadAll cannot grow without limit.
smeinecke
added a commit
to smeinecke/cycletls_python
that referenced
this pull request
Oct 26, 2026
Port of Danny-Dasilva/CycleTLS#430 (CVE-2026-111497 / HTTP2Shell). The Go brotli port shares the block-switch bug: malformed input panics, so any hostile server could crash the process via Content-Encoding: br in DecompressBody or via compress_certificate - we advertise brotli cert compression for every Chromium and Firefox fingerprint. - github.com/andybalholm/brotli v1.2.6 -> v1.2.7 - readLimited() caps gzip/deflate/brotli inflate at 64 MiB so a small compressed payload cannot inflate without bound (decompression bomb). DecompressBody keeps its return-original-on-error contract, so over-limit bodies pass through untouched.
emircan-sahin
added a commit
to emircan-sahin/cycletls
that referenced
this pull request
Oct 31, 2026
v1.2.0 panics on a crafted stream (upstream Danny-Dasilva#430); utls decodes brotli for certificate compression on a goroutine no recover covers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
github.com/andybalholm/brotlifrom v1.2.0 to v1.2.7 incycletls/,src/, and the root module so Go MVS also lifts the copy used byutls/fhttp/uquic.Content-Encoding: brinDecompressBodyand on TLS cert compression (utls.CertCompressionBrotli).io.LimitReader(64 MiB) soio.ReadAllcannot grow without bound.Test plan
go list -m github.com/andybalholm/brotliis v1.2.7 incycletls/,src/, and rootgo testincycletls/(includesdecompress_test.go: valid Brotli, invalid Brotli does not panic, size cap)go test -tags=integration ./cycletls/tests/iegration -run 'TestBrotli|TestGZIP|TestDeflate'if httpbin is reachable