CVE Intelligence
Analysis AI-assisted

CVE-2026-13762: Amazon CloudFront HTTP/2 Request Body Inspection Bypass with AWS WAF

CVE-2026-13762 is a critical issue (CVSS 3.1 base score 9.8, as published by the CNA) in Amazon CloudFront with AWS WAF enabled. Crafted HTTP/2 requests that split the body across frames may cause WAF managed rule body inspection to examine only part of the body. The source states the issue was fixed server-side and that no customer action is required.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13762 describes an inconsistent interpretation of HTTP/2 requests in Amazon CloudFront when AWS WAF is enabled. According to the record, requests that split the body across HTTP/2 frames may cause WAF managed rule body inspection to cover only part of the body. The weakness is categorized as CWE-444 (HTTP Request Smuggling). The vendor reference is the AWS security bulletin 2026-048.

Impact

  • The source describes the potential result as bypass of AWS WAF managed rule body inspection, which could let malicious content reach the protected application without being fully inspected.
  • The CNA scores the issue at CVSS 3.1 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which implies network exploitation with low complexity and no privileges or user interaction. The CNA also lists a CVSS 4.0 score of 7.9.
  • The record does not state the concrete consequences for any specific customer application. Any such impact is an inference and depends on the rules in use and on the application behind the WAF.

Affected products and versions

  • Product: Amazon CloudFront, used with AWS WAF.
  • Versions: the record states 'versions not specified by the source'. No affected version range is available in the sources consulted.
  • Fixed versions: none are listed in the record. The source states the issue was remediated server-side, so customers are not expected to upgrade or reconfigure, but the record does not name a fixed build.

Exploitation status

The CISA Known Exploited Vulnerabilities catalog does not list this CVE in the record, so no KEV-based exploitation is recorded. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00626 (percentile 0.48616), dated 2026-10-13, which is an estimated likelihood score and not evidence of exploitation.

Remediation and mitigation

  • According to the source, the fix was applied server-side by the provider and no customer action is required.
  • Keep the AWS WAF managed rule sets and CloudFront configuration reviewed against the official AWS bulletin, and follow any further guidance AWS publishes.
  • Defense-in-depth: do not rely solely on WAF body inspection for security-critical validation. Apply input validation and authorization checks in the application itself.

Detection guidance

  • Review AWS WAF logs and CloudFront access logs for unusual HTTP/2 request patterns, unexpected request body sizes, or blocked versus allowed requests that do not match expected behavior.
  • Correlate WAF events with application-side logs to identify requests that reached the origin despite WAF rules that should have blocked them.
  • Treat these checks as general monitoring. The record does not provide specific indicators of compromise.

Limitations of the available information

  • The record gives no affected version range, no fixed version identifiers, and no detailed technical description beyond the summary.
  • The sources consulted are the NVD and CVE.org records and the AWS bulletin listed in the references. The AWS bulletin content was not available for this analysis beyond what the record quotes.
  • The CVSS 3.1 and 4.0 scores are reported by the CNA and have not been independently verified here.
  • Whether particular WAF rule sets, request types or deployments are more exposed is unknown from the record.

Frequently asked questions

What is CVE-2026-13762?

It is a reported issue in Amazon CloudFront with AWS WAF enabled, where crafted HTTP/2 requests split across frames may cause WAF managed rule body inspection to examine only part of the request body.

Do I need to take action?

The source states the issue was remediated server-side and that no customer action is required. The record does not list affected or fixed versions, so you should review the AWS bulletin for current guidance.

Is this vulnerability known to be exploited?

It is not listed in the CISA KEV catalog in this record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.