Vulnerabilities & Exploits · Web App Attack

AWS WAF Can Miss Fragmented HTTP/2 Bodies

AWS WAF can be tricked into inspecting only part of an HTTP/2 request body when the body is split across frames, so the rule set sees a partial request and misses the rest. That breaks the usual assumption that a managed WAF at the load balancer layer is fully filtering what reaches the app.

AWS disclosed two high-severity issues: CVE-2026-13763 affects AWS Application Load Balancer HTTP/2 target groups, and CVE-2026-13762 was fixed server-side for Amazon CloudFront. On ALB, the customer-side gap remains until the target-group setting "Inspect after sufficient data" is enabled, which is what restores full body inspection.

For teams relying on AWS WAF managed rules, the risk is configuration-based rather than a patching exercise. CloudFront is already covered, but ALB HTTP/2 users still have exposure until the inspection setting is turned on.

1 source · Jun 30

Timeline

• Jun 30 Reported by INCIBE-CERT

Sources

• Jun 30 INCIBE-CERT

  Múltiples vulnerabilidades en el WAF de AWS

  AWS ha publicado 2 vulnerabilidades de severidad alta que, en caso de ser explotadas, podrían permitir

  original

Part of the PlainSec briefing for 2026-06-30

Every edition of this story: AWS WAF Can Miss Fragmented HTTP/2 Bodies

More from today

• Oracle Payments Bug Can Leak the Keys Behind It
• Defender Flaw Becomes Ransomware’s Privilege Shortcut
• Exposed Langflow Apps Become Network Pivots