CVE-2026-13763

Think of AWS WAF as a security guard that checks incoming requests for harmful content. With this issue, the “guard’s inspection” can get tricked when traffic comes in using HTTP/2 and the request content arrives in pieces, so the guard may only check part of what’s actually coming. That creates a pathway for harmful content to get through the usual checks and reach your application.

This matters if you run AWS Application Load Balancer with AWS WAF enabled and your traffic to the ALB uses HTTP/2, since the flaw is in the HTTP/2 request parsing and its impact on WAF body inspection. It’s a remote issue that does not require a login or user interaction. Whether it’s reachable depends on your ALB configuration and whether the affected HTTP/2 inspection paths are actually used in your setup (the findings don’t confirm default reachability).

Treat this as urgent to address in the near term because it targets WAF body inspection and is triggered remotely with no authentication. There is no public exploit code on record and this issue is not listed in CISA KEV, so it is not confirmed as widely exploited; however, the impact potential (malicious payloads reaching your application) is high enough to warrant immediate configuration review.