Question regarding HashiCorp Vault OSS exposure to Brotli vulnerability

Vault
1

Hi everyone,

I recently read a security advisory regarding the HTTP2Shell vulnerability (CVE-2026-111497) in Google’s Brotli compression library.

While initial reports focused primarily on Node.js and C implementations, recent findings from HTTP2Shell: Go Brotli Vulnerability, Risks and Remediation confirm that the native Go port of ( GitHub - andybalholm/brotli: Pure Go Brotli encoder and decoder · GitHub v1.2.0 // indirect) is also vulnerable up to version 1.2.6. In Go environments, processing a malformed Brotli-compressed HTTP payload can trigger an out-of-bounds runtime panic, leading to a potential Denial of Service (DoS).

Given that HashiCorp Vault is built on Go, I wanted to ask the community :

  1. Is Vault exposed to this vulnerability? Does Vault utilize the Brotli library either directly or transitively through its HTTP infrastructure/dependencies?
  2. Is request/response decompression handled anywhere? If the dependency exists, are there active code paths where Vault attempts to decompress untrusted, attacker-controlled Brotli payloads?
  3. Are there any planned updates? If Vault is affected, is there a timeline for upgrading the dependency to the patched version (v1.2.7 or later)?

Any insights on potential exposure or mitigation recommendations would be greatly appreciated.

Thanks in advance,