CVE-2026-13763

Name of the Vulnerable Software and Affected Versions AWS Application Load Balancer (affected versions not specified)

Description Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer when AWS WAF is enabled may allow remote actors to bypass managed rule body inspection. By crafting HTTP/2 requests that fragment the request body across multiple data frames, an attacker can ensure only a partial body is inspected, potentially allowing malicious payloads to reach the backend. This issue specifically impacts ALB target groups routing to HTTP/2 targets.

Recommendations Enable the "Inspect after sufficient data" target group configuration associated to the ALB load balancer.