Mozilla reported HTTP2Shell with proof of RCE in April
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Mozilla reportedly received a report, HTTP2Shell, describing a remote memory-corruption bug in the Brotli decoder vendored in Firefox, with a claimed proof of remote code execution.