Why One HTTP Header Parser Bug Reached .NET, FFmpeg, ClickHouse, and Apache Arrow
One HTTP header parsing flaw — reported under the researcher names HTTP2Shell and PHP2Shell — has reportedly reached .NET, FFmpeg, ClickHouse, and Apache Arrow, and CISA has reportedly warned that one side is under active attack. This short separates what the public reporting actually supports from what it doesn't: the summaries carry no CVE identifier, no affected version ranges, and no named parser function. Then it looks at the bug class itself. Header parsing is string handling with security consequences, and what spread between these four ecosystems is a permissive mental model — split on the colon, trim, lowercase, merge duplicates, move on — not a single shared line of code. What the video covers: - The reported timeline of 27 and 28 October 2026, and which outlet said what - RFC 9110 and RFC 9112 on whitespace before the colon, obsolete line folding, duplicate field names, and Transfer-Encoding together with Content-Length - The decision points where parsers diverge, and why divergence is the exploitable part - Why Kestrel, FFmpeg's HTTP protocol handler, the ClickHouse HTTP interface, and Arrow Flight all end up parsing headers outside a hardened frontend - The trust boundary that matters: attacker-controlled bytes, parser A, normalized value, parser B - How to scope and test your own exposure before you patch This is defensive, lab-scoped material: header grammar probes only, with no exploit payloads and no target lists. Names are not identifiers — for triage, go to the CISA Known Exploited Vulnerabilities catalog and the vendor bulletin for your specific versions, not to a news summary. The author's sources here are secondary summaries, and the post lists what was not tested. Read the full post: https://hackyjs.com/posts/why-one-http-header-parser-bug-reached-net-ffmpeg-clickhouse-and-apache-arrow