CVE Intelligence
Analysis AI-assisted

CVE-2026-13763: AWS Application Load Balancer HTTP/2 Request Body Inspection Bypass with AWS WAF

CVE-2026-13763 is a critical issue in Amazon Application Load Balancer with AWS WAF enabled, where inconsistent interpretation of HTTP/2 requests may let remote actors evade managed rule body inspection. The CNA reports CVSS 3.1 9.8 and CVSS 4.0 7.9, and states that only HTTP/2 ALB target groups are affected. AWS documents a target group configuration, "Inspect after sufficient data", as the remediation path, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-13763 describes an inconsistent interpretation of HTTP/2 requests in Amazon Application Load Balancer (ALB) when AWS WAF is enabled. According to the CNA description, the request body can be split across HTTP/2 frames so that AWS WAF managed rule body inspection only examines part of it. The record classifies the issue as CWE-444 (HTTP Request Smuggling) and states that only HTTP/2 ALB target groups are affected.

Impact

The CNA states that the flaw might allow remote actors to bypass AWS WAF managed rule body inspection. The CNA scores it as CVSS 3.1 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and as CVSS 4.0 7.9. A WAF bypass of this kind would mean malicious request content may not be filtered as intended. The record does not describe the concrete effects on backend applications, so the practical impact for a specific workload is unknown.

Affected products and versions

  • Product: Amazon Application Load Balancer, specifically HTTP/2 ALB target groups with AWS WAF enabled.
  • Versions: the record gives no version information; the source does not specify affected versions.
  • Fixed versions: none are listed in the record.

Exploitation status

The CISA KEV catalog does not list this CVE in the record provided, so no confirmed active exploitation is established by the sources consulted. The EPSS estimate in the record is a probability of 0.00676 with a percentile of 0.50976 (dated 2026-10-13); EPSS is a predictive estimate, not evidence of exploitation.

Remediation and mitigation

  • Review AWS's guidance for this issue, listed in the references, and check whether your environment uses HTTP/2 ALB target groups together with AWS WAF.
  • Enable the "Inspect after sufficient data" target group configuration on the affected ALB target groups, as described in the AWS product documentation.
  • Because the record lists no fixed version, treat the target group configuration as the documented remediation path and confirm the current status with AWS.

Detection guidance

  • Inventory ALB target groups that use HTTP/2 and have AWS WAF associated, and record whether the "Inspect after sufficient data" setting is enabled.
  • Review WAF logs for requests with unusual body sizes or structures on HTTP/2 paths, and correlate them with backend application logs.
  • Keep in mind that a bypass may leave few obvious WAF events, so use backend and application telemetry as a complement.

Limitations of the available information

  • No affected or fixed version numbers are provided in the record.
  • The AWS security bulletin is referenced, but its full content is not part of the record, so details beyond the CNA description are unknown.
  • No independent technical analysis, proof of concept, or exploitation reports are included in the sources consulted, and this analysis does not add any.
  • The record title is empty; the title in this analysis was written from the description.

Frequently asked questions

What is CVE-2026-13763?

It is a critical issue in Amazon Application Load Balancer with AWS WAF enabled, where inconsistent HTTP/2 request handling may let remote actors bypass managed rule body inspection.

Which configurations are affected?

According to the record, only HTTP/2 ALB target groups are affected. The record does not specify affected software versions.

How can organizations remediate it?

AWS guidance in the record says to enable the "Inspect after sufficient data" target group configuration associated with the ALB load balancer.

Is this vulnerability being exploited?

The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.