HTTP2Shell
CIA Risk Posture & Executive Assurance
Attackers can forge session tickets to bypass mutual TLS (mTLS), gaining unauthorized access to internal-only APIs and partner endpoints.
Compromising the reverse proxy or Kubernetes ingress gateway exposes every internal application behind it, even if those apps are fully patched.
Edge proxy worker crashes sever traffic routing for all downstream websites, APIs, and microservices simultaneously.
If mutual TLS (mTLS) protects B2B or internal routes, TLS session tickets must be disabled or proxies upgraded to prevent silent authentication bypass.
Patching the external load balancer is not enough if internal Kubernetes ingress controllers (NGINX, Envoy, Istio) remain on vulnerable releases.
Reverse proxies and Kubernetes ingress gateways face two converging HTTP-layer threats: Brotli decompression RCE in Envoy Proxy and Istio, plus five NGINX worker memory, HTTP/3, and mTLS bypass advisories.
Why CVE-2026-111497 appears here too:
Envoy Proxy embeds the exact same upstream Google Brotli decoder as Node2Shell,
so it is the same Brotli bug with a different blast radius—striking
perimeter ingress gateways and Istio service meshes rather than individual app runtimes.
Because edge proxies inspect traffic first, a compromise or authentication bypass at the proxy layer exposes every internal service behind it.
Why it’s a risk
Envoy & Istio RCE (CVE-2026-111497 · Same Brotli Bug):
Gateways with the Brotli decompressor filter enabled suffer the same out-of-bounds write (CVSS v4.0 9.2) as Node2Shell, risking remote code execution at the cluster edge.
NGINX Memory & mTLS Flaws: Two heap buffer overflows (CVE-2026-15176,
CVE-2026-93479) and an AIO/SSI use-after-free (CVE-2026-97205)—scored
8.1 High in CVSS v3.1 (9.2 in v4.0, rated Medium by NGINX)—corrupt worker memory, while
CVE-2026-97629 (6.5 Medium v3.1) forges TLS resumption tickets to bypass mTLS and CVE-2026-95101 (5.3 Medium v3.1) enables HTTP/3 body injection.
How to recognize it (Versions & Logs)
-
Vulnerable versions: NGINX
< 1.31.7/< 1.30.6; Envoy<= 1.39.2/1.38.5/1.37.7; Istio<= 1.31.1/1.30.5. -
In your logs: NGINX
worker process ... exited on signal 11crash entries inerror.log, or unexpected TLS session resumptions on mTLS-protected routes.
How to mitigate it
-
Upgrade ingress & proxy binaries: Update
NGINX to
1.31.7or1.30.6, Envoy to1.40.0/1.39.3, and Istio to1.31.2/1.30.6. -
Hardening settings: Disable the Brotli
decompressor filter in Envoy/Istio, set
proxy_request_buffering off;for NGINX HTTP/3, and setssl_session_tickets off;on mTLS endpoints.
| Edge Proxy / Mesh | Vulnerable Releases | First Fixed Release |
|---|---|---|
| NGINX | 0.1.29 – 1.31.6 · 1.30.0 – 1.30.5 | 1.31.7 · 1.30.6 |
| Envoy Proxy | <= 1.39.2 · <= 1.38.5 · <= 1.37.7 | 1.40.0 · 1.39.3 · 1.38.6 · 1.37.8 |
| Istio | <= 1.31.1 · <= 1.30.5 | 1.31.2 · 1.30.6 |