Learn how to review CVE-2026-111497 findings in Aqua Enforcer images and plan remediation.

Applies to: Aqua Security customers with CVE-2026-111497 reported in Aqua Enforcer images.

UPDATE: October 26, 2026

Aqua has released U47 SP2 Enforcer, available as registry.aquasec.com/enforcer:2022.4.951.5, which includes the fix for this CVE.

UPDATE: October 26, 2026

Internal reviews have not currently found any Aqua operations or code functions that make use of the vulnerable Brotli decoder; however, as our official investigation remains underway, our recommendation continues to be to upgrade to the remediated 2022.4.951.5 version

UPDATE: October 27, 2026

Release Notes: 2022.4.U47 SP2 Release Documentation.

UPDATE: October 27, 2026 — Fix available

Aqua Enforcer 2022.4.951.5 (U47 SP2) includes the fix for CVE-2026-111497, also known as HTTP2Shell or Node2Shell.
The corrected image is available at: registry.aquasec.com/enforcer:2022.4.951.5

Customers using affected Enforcer versions should upgrade to 2022.4.951.5 to remediate this vulnerability.

UPDATE: October 29, 2026 — LTS Fix available

LTS fix available: The fix for CVE-2026-111497 (HTTP2Shell/Node2Shell) is available in LTS U45 SP9.
Customers using the LTS stream are recommended to upgrade to U45 SP9 i.e. 2022.4.880.50.

Release Notes: 2022.4.U45 LTS SP9 Release Documentation

Overview

CVE-2026-111497, also referred to as HTTP2Shell or Node2Shell, is a memory corruption vulnerability in the Brotli decompression library. Processing specially crafted Brotli-compressed data can cause a process crash, disclose memory, or potentially allow arbitrary code execution. Despite the HTTP2Shell name, the vulnerability is in Brotli decoding rather than the HTTP/2 protocol itself.

The vulnerability is identified in Aqua Enforcer. The fix is available in U47 SP2 Enforcer version 2022.4.951.5.

What does a detection in Aqua Enforcer mean?

A vulnerability finding identifies a component associated with CVE-2026-111497 in the scanned Enforcer image.

The presence of the component does not, by itself, establish that an Enforcer deployment is exploitable. Exploitation requires a vulnerable decoder to process attacker-controlled Brotli-compressed data.

For questions about a specific Enforcer image or deployment, contact Aqua Support with the finding details.

Affected versions and fixed release

CVE-2026-111497 is identified in the following Aqua Enforcer versions:

Note: The versions listed above are identified affected builds and should not be treated as an exhaustive list. The fix is available in 2022.4.951.5 (U47 SP2).

Recommended actions for Aqua Security customers

1. Review the finding

Review the vulnerability report for the affected Enforcer image and record:

• Full image repository, tag, and digest.

• Enforcer version and build.

• Detected package or binary name, version, and file path.

• Scanner name, version, and scan date.

These details help Aqua Support validate the finding against the specific image in use.

2. Upgrade Aqua Enforcer

Review the release notes and follow the documented Aqua Enforcer upgrade procedure to deploy the corrected image: registry.aquasec.com/enforcer:2022.4.951.5.

For findings in an Aqua-provided image, remediation should be applied through the updated Aqua release. Upgrading a Brotli package on the underlying host does not replace a copy bundled inside the Enforcer image.

3. Scan the updated image and verify remediation

After upgrading:

1. Confirm that the running Enforcers use the updated image and build.

2. Scan the updated Enforcer image using current vulnerability intelligence.

3. Review the results for CVE-2026-111497.

4. If the finding remains, share the updated scan report and image details with Aqua Support.

For deployments using Offline CyberCenter, apply the latest available vulnerability database update before scanning.

Frequently asked questions

• Is the fix available?

Yes. The fix is available in U47 SP2 Enforcer version 2022.4.951.5, using the image registry.aquasec.com/enforcer:2022.4.951.5.

• Can I resolve this by updating Brotli on the host?

Updating the host package does not update a separate copy included in the Enforcer image. Upgrade Aqua Enforcer to 2022.4.951.5, which includes the fix.

• Do Aqua runtime controls replace the required update?

Runtime controls should not be treated as a confirmed mitigation for this vulnerability in Enforcer. Remediation is available by upgrading Aqua Enforcer to 2022.4.951.5.

Additional resources

• HTTP2Shell: Find and Fix Vulnerable Brotli Copies with Tanium

• Google Brotli release notes

• Aqua Security blog

For assistance reviewing an Enforcer finding or planning the upgrade, contact Aqua Support.