The name is misleading sensationalism
Many argue the bug is in Google's Brotli decoder, so calling it HTTP2Shell is marketing hype; Brotli2Shell or the CVE number would be more accurate.
Unclear real-world exposure
Commenters debate how many servers actually decode Brotli request bodies by default, versus client-side or outbound-fetch exposure, and whether proxies or load balancers shield apps.
Complexity and C are the root problem
Some blame added protocol complexity, too many dependencies, and memory-unsafe C, pointing to Dropbox's Rust Brotli as a drop-in alternative.