CVE-2026-13762
Last modified
CVE-2026-13762 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Amazon | Cloudfront | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-13762?
How severe is CVE-2026-13762?
How do I fix CVE-2026-13762?
Related CVEs from 2026
- CVE-2026-13756The WP Grid Builder plugin for WordPress is vulnerable to Pr…8.8
- CVE-2026-13757A flaw was found in p11-kit. The RPC message attribute parsi…6.2
- CVE-2026-13758CryptX versions before 0.088_001 for Perl compare AEAD authe…3.7
- CVE-2026-13759IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships th…8.8
- CVE-2026-1376IBM i 7.6 could allow a remote attacker to cause a denial of…7.5
- CVE-2026-13760OS command injection in the NodejsFunction Docker bundling p…7.3
- CVE-2026-13763Inconsistent interpretation of HTTP/2 requests in AWS Applic…9.8
- CVE-2026-13766DBIx::QuickORM versions before 0.000026 for Perl allow SQL i…9.8
- CVE-2026-13768Gardyn devices expose a privileged iothubowner key. Access t…10
- CVE-2026-13769Overly permissive file permissions in AWS CLI before 1.44.78…6.8
- CVE-2026-1377The imwptip plugin for WordPress is vulnerable to Cross-Site…4.3
- CVE-2026-13771The Customer Reviews for WooCommerce plugin for WordPress is…6.4
Are you affected by CVE-2026-13762?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST