CVE-2026-13763

Critical · CVSS 9.8

AWS Application Load Balancer (ALB) with AWS WAF — HTTP Request Smuggling / Inconsistent HTTP/2 Request Interpretation (WAF Bypass) - CWE-444

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-444

Description

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups. To remediate this issue, customers should enable the "Inspect after sufficient data" target group configuration associated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection )

Search profile — drives PoC discovery

Symbols HTTP/2ALBAWS WAFmanaged rule body inspectionHTTP/2 framesrequest body fragmentationInspect after sufficient datawaf-http2-inspectiontarget group configurationHTTP/2 ALB target groups

Keywords CVE-2026-13763AWS ALB WAF bypassHTTP/2 body inspection bypassAWS WAF HTTP/2 request smugglingALB HTTP/2 frame fragmentationWAF managed rule bypass ALBHTTP/2 partial body inspectionAWS Application Load Balancer WAF evasionInspect after sufficient data ALBCWE-444 AWS WAF

Versions: AWS ALB with AWS WAF enabled on HTTP/2 target groups (prior to enabling "Inspect after sufficient data" mitigation)

References

Status: enriched · ingested 2026-07-02T00:00:43.000Z · profiled 2026-07-02T00:30:43.000Z