Is CVE-2026-13763 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13763 being exploited in the wild.

How severe is CVE-2026-13763?

Critical severity, with a CVSS score of 9.8, published 29 June 2026.

Which products and versions are affected?

AWS Application Load Balancer All versions using HTTP/2 target groups.

Is there a fix for CVE-2026-13763?

A patch was published on 2026-05-22: Remediation configuration option released by AWS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13763 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-13763?

Check whether you run AWS Application Load Balancer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13763: AWS Application Load Balancer WAF bypass via HTTP/2 multi-frame requests

CVE-2026-13763 · Severity: critical · CVSS 9.8 · Published 2026-06-29

AWS Application Load Balancer (ALB) has a vulnerability where it may fail to properly inspect the full content of certain web requests when AWS WAF is enabled. An attacker could bypass security rules by splitting a malicious request into multiple parts, potentially allowing unauthorized or harmful traffic to reach your backend servers. This issue specifically affects load balancers configured to use HTTP/2 for their target groups.

Vendors: AWS.

Quick answers

Is CVE-2026-13763 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13763 being exploited in the wild.
How severe is CVE-2026-13763?: Critical severity, with a CVSS score of 9.8, published 29 June 2026.
Which products and versions are affected?: AWS Application Load Balancer All versions using HTTP/2 target groups.
Is there a fix for CVE-2026-13763?: A patch was published on 2026-05-22: Remediation configuration option released by AWS Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13763 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-13763?: Check whether you run AWS Application Load Balancer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability classified as CWE-444 (Inconsistent Interpretation of HTTP Requests) exists in AWS Application Load Balancer when integrated with AWS WAF. The flaw stems from how the ALB handles HTTP/2 multi-frame request bodies; an attacker can fragment a request body across multiple frames such that the WAF only inspects a partial body, effectively bypassing security rules. This issue specifically impacts ALB target groups configured for HTTP/2. AWS has released a remediation via a new target group attribute, 'Inspect after sufficient data', which forces the ALB to accumulate data frames before performing WAF inspection.

Affected products

AWS Application Load Balancer (ALB) All versions using HTTP/2 target groups

Timeline

2026-05-22: patched: Remediation configuration option released by AWS
2026-06-29: disclosed: Public advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.