CVE-2026-137629.8CriticalCWE-444

CVE-2026-13762: HTTP/2 Stream Parser Confusion Body-Inspection Bypass in Amazon CloudFront with AWS WAF

AWS · Amazon CloudFront

Vendor fix available · Affected: AWS Amazon CloudFront · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.6%probability of exploitation in the next 30 days

50th percentile

050100

Higher than 50% of scored CVEs

9.8CriticalCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

AWS · Amazon CloudFront0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Inconsistent Interpretation of HTTP Requests · Injection and Smuggling
Vendor: AWS
Published: June 2026
Band: Unlikely (under 1%), June 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-13762 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.