CVE-2026-13763: Amazon Application Load Balancer

Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days.

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups. To remediate this issue, customers should enable the "Inspect after sufficient data" target group configuration associated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection )

Affected products

• Amazon Application Load Balancer: affected versions not specified

Published 2026-06-29. Last modified 2026-07-01.