CVE-2026-13762

Critical · CVSS 9.8

Amazon CloudFront with AWS WAF — HTTP/2 request smuggling / WAF body inspection bypass (CWE-444: Inconsistent Interpretation of HTTP Requests)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-444

Description

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.

Search profile — drives PoC discovery

Symbols HTTP/2AWS WAFCloudFrontmanaged rule body inspectionHTTP/2 framesrequest body fragmentationpartial body inspectionDATA frameHEADERS frame

Keywords CVE-2026-13762CloudFront WAF bypassHTTP/2 body fragmentation WAF bypassAWS WAF managed rules bypassHTTP/2 frame body inspection bypassrequest smuggling CloudFrontCWE-444 AWSHTTP/2 partial body WAF evasionCloudFront HTTP2 WAF evasion PoC

Versions: All AWS CloudFront distributions with AWS WAF enabled prior to server-side remediation (2026-048-aws)

References

https://aws.amazon.com/security/security-bulletins/2026-048-aws/

Status: enriched · ingested 2026-07-02T00:00:43.000Z · profiled 2026-07-02T00:30:43.000Z