HTTP2Shell: Critical Brotli Flaw (CVE-2026-111497) and WordPress Risk

Wordfence published an analysis on HTTP2Shell on 2 November 2026, the name circulating for CVE-2026-111497, a critical vulnerability in the Brotli decoder with direct impact on WordPress sites. Anyone running hosting infrastructure needs to understand one simple fact: WordPress is not the problem, but rather the compression library used by the server beneath it.

What Wordfence says

On 22 October 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project had released corrected versions. CVE-2026-111497 is an out-of-bounds write in the Brotli decoder. It is a critical vulnerability in Brotli, not in WordPress, but WordPress can provide a pathway to the vulnerable decoder.

The practical point for site administrators: you must ask your hosting provider whether the Brotli library used by your site has been patched for CVE-2026-111497, because updating WordPress, a plugin or a theme does not update this library at the server level.

On the exploit front, Wordfence is cautious: CISA lists CVE-2026-111497 as noted for active exploitation, but its public entry does not identify the affected application, attack vector or outcome; sensor networks continue to record exploitation attempts, but public reports examined up to 2 November document neither successful production compromise nor compromise through WordPress. For those using managed hosting, the recommendation remains the same: managed hosting customers should ask their provider to confirm that every copy of Brotli used by their site contains the fix for CVE-2026-111497 and that affected services have been restarted or redeployed.

Timeline and severity

On 27 October 2026, CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalogue. The flaw affects Brotli versions from 1.0.3 to 1.0.9, 1.1.0 and 1.2.0; patched versions are 1.0.10, 1.1.1 and 1.2.1.

Patched versions by distribution

On the official Ubuntu Security Notices page, the brotli package shows patched status as follows: Ubuntu 22.04 LTS at version 1.0.9-2ubuntu0.1, Ubuntu 24.04 LTS at version 1.1.0-2ubuntu0.1, Ubuntu 26.04 LTS at version 1.2.0-3ubuntu0.1. The severity score reported by Ubuntu is CVSS 3.1 of 9.8, critical.

What to do

Anyone running VPS or dedicated servers must check the installed version of the brotli package (or libbrotli) and update it through your distribution's package manager, then restart services that load it (web server, reverse proxy, application runtimes). Those using shared or managed hosting should request written confirmation from their provider.