Which versions of Amazon CloudFront are affected by CVE-2026-13762?

A request smuggling vulnerability in Amazon CloudFront's WAF integration (CVE-2026-13762, CVSS 7.9) allowed attackers to bypass web application firewall protections by fragmenting HTTP/2 requests,…

Is there a public PoC exploit available for CVE-2026-13762?

Yes, a public proof-of-concept exploit is available for CVE-2026-13762. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-13762?

24 hours: Confirm all CloudFront distributions have AWS WAF enabled; request AWS account confirmation that server-side remediation is deployed. 7 days: Pull CloudFront and application access logs for the pre-remediation period; search for unusual HTTP/2 request patterns or anomalous traffic to protected origins; audit WAF rule configurations. 30 days: Complete forensic review of logs for evidence of unauthorized data access or privilege escalation; implement compensating HTTP/2 request validation controls if custom origin protection is deployed.

Amazon CloudFront CVE-2026-13762

Q: What is the CVSS score of CVE-2026-13762?

CVE-2026-13762 has a CVSS 4.0 base score of 7.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-40220 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-06-29 AMZN

GHSA-9jjc-h3c2-fw2v

Request Smuggling Authentication Bypass Amazon Cloudfront

7.9

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

7.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Remote, unauthenticated, low-complexity HTTP/2 trigger (AV:N/AC:L/PR:N/UI:N); scope changes to the protected origin (S:C) with high integrity impact from smuggled payloads, while the bypass alone causes no direct disclosure or denial (C:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 20:30 vuln.today

Severity Changed

Jun 29, 2026 - 20:22 NVD

CRITICAL HIGH

CVSS changed

Jun 29, 2026 - 20:22 NVD

9.8 (CRITICAL) 7.9 (HIGH)

DescriptionCVE.org

Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected.

This issue was remediated server-side. No customer action is required.

AnalysisAI

WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies past managed rule inspection by fragmenting the HTTP/2 request body across frames so only a partial body is examined. The flaw (CWE-444, request smuggling) defeats the protective security control rather than CloudFront itself, allowing attacks the WAF would normally block to reach the protected origin. AWS remediated it server-side with no customer action required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The issue is a classic CWE-444 inconsistent-interpretation/request-smuggling class flaw, specific to HTTP/2 frame handling. HTTP/2 allows a single request body (DATA frames) to be split across multiple frames; here CloudFront's AWS WAF managed rule body inspection evaluated only a partial reassembly of that fragmented body, while the downstream origin processed the full reconstructed request. The affected component per CPE is cpe:2.3:a:aws:amazon_cloudfront - the CloudFront CDN/edge service when fronted by AWS WAF managed rules that perform body inspection (e.g., SQLi/XSS/payload rules). The vulnerability lives in the parsing/inspection boundary between the edge proxy and its WAF inspection engine, not in customer code.

RemediationAI

Patch available per vendor advisory - AWS states the issue was remediated server-side with no customer action required, so no upgrade, redeployment, or configuration change is needed on the customer side. Defenders should review the AWS bulletin (https://aws.amazon.com/security/security-bulletins/2026-048-aws/) to confirm applicability, and as durable defense-in-depth ensure origin applications independently validate and sanitize input rather than relying solely on edge WAF inspection, since WAF is a compensating layer and not a substitute for application-level controls. If concerned about HTTP/2-specific smuggling generally, consider enabling origin-side request normalization and, where feasible, constraining or monitoring HTTP/2 body framing - with the trade-off that strict framing limits can affect legitimate clients using chunked or multi-frame uploads.