Letta Classic was shipping HTTP2Shell

HTTP2Shell (CVE-2026-111497) is a 9.2 in Google's Brotli decoder — out-of-bounds write, both directions, if you decode a crafted br blob. Pilvar dropped the writeup this morning.

Letta Classic pulls Brotli because the HTTP stack will decode brotli if the wheel is sitting in the venv. Our pin was brotli>=1.1.0. 1.1.0 is in the kill range (1.0.3 through 1.2.0). That's the library your agent uses when it fetches a page.

Thea caught it. We walked the managed boxes the same morning. Python wheels are on 1.2.1. Letta got restarted so the old .so wasn't still mapped. DSC-managed Sanctum / Letta Classic installs were upgraded automatically.

I'm not going to dress this up as a framework bug. It's a compression library. Letta just happened to depend on a version that still had the hole.

If you run Letta Classic yourself — Technonomicon fork or the Sanctum kernel — the pin is now brotli>=1.2.1 on technonomicon-lore/letta main and sanctumos/letta (main and venice-openai-proxy). A fresh uv sync gets you the patched wheel. A lockfile sitting on 1.1.0 will put the hole back the next time you sync without upgrading the package.

Existing installs

From the Letta kernel directory:

uv lock --upgrade-package brotli
uv pip install "Brotli>=1.2.1"
python -c "import brotli; print(brotli.__version__)"

uv lock --upgrade-package brotli uv pip install "Brotli>=1.2.1" python -c "import brotli; print(brotli.__version__)"

You want 1.2.1 or newer. Then restart Letta. pip and uv will not unload the old decoder from a running process. We had to bounce the server for the patch to actually be live.

Pip-only venv, no uv:

bash
pip install -U "Brotli>=1.2.1"

You want 1.2.1 or newer. Then restart Letta. pip and uv will not unload the old decoder from a running process. We had to bounce the server for the patch to actually be live.

uv lock --upgrade-package brotli
uv pip install "Brotli>=1.2.1"
python -c "import brotli; print(brotli.__version__)"

You want 1.2.1 or newer. Then restart Letta. pip and uv will not unload the old decoder from a running process. We had to bounce the server for the patch to actually be live.

Pip-only venv, no uv:

bash
pip install -U "Brotli>=1.2.1"

Same restart after.

Ubuntu has not shipped a libbrotli1 security rev yet. curl --compressed still waits on that. nginx as a server is not decoding request-body brotli. The Letta path is the Python wheel. That's the one we pinned.

Don't leave the lock on 1.1.0 and tell yourself you'll get to it Monday.