AWS WAF can be tricked into inspecting only part of an HTTP/2 request body when the body is split across frames, so the rule set sees a partial request and misses the rest. That breaks the usual assumption that a managed WAF at the load balancer layer is fully filtering what reaches the app.
AWS disclosed two high-severity issues: CVE-2026-13763 affects AWS Application Load Balancer HTTP/2 target groups, and CVE-2026-13762 was fixed server-side for Amazon CloudFront. On ALB, the customer-side gap remains until the target-group setting "Inspect after sufficient data" is enabled, which is what restores full body inspection.
For teams relying on AWS WAF managed rules, the risk is configuration-based rather than a patching exercise. CloudFront is already covered, but ALB HTTP/2 users still have exposure until the inspection setting is turned on.