EUVD-2026-40220
GHSA-9jjc-h3c2-fw2v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity HTTP/2 trigger (AV:N/AC:L/PR:N/UI:N); scope changes to the protected origin (S:C) with high integrity impact from smuggled payloads, while the bypass alone causes no direct disclosure or denial (C:N/A:N).
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
3DescriptionCVE.org
Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected.
This issue was remediated server-side. No customer action is required.
AnalysisAI
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies past managed rule inspection by fragmenting the HTTP/2 request body across frames so only a partial body is examined. The flaw (CWE-444, request smuggling) defeats the protective security control rather than CloudFront itself, allowing attacks the WAF would normally block to reach the protected origin. AWS remediated it server-side with no customer action required; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The issue is a classic CWE-444 inconsistent-interpretation/request-smuggling class flaw, specific to HTTP/2 frame handling. HTTP/2 allows a single request body (DATA frames) to be split across multiple frames; here CloudFront's AWS WAF managed rule body inspection evaluated only a partial reassembly of that fragmented body, while the downstream origin processed the full reconstructed request. The affected component per CPE is cpe:2.3:a:aws:amazon_cloudfront - the CloudFront CDN/edge service when fronted by AWS WAF managed rules that perform body inspection (e.g., SQLi/XSS/payload rules). The vulnerability lives in the parsing/inspection boundary between the edge proxy and its WAF inspection engine, not in customer code.
RemediationAI
Patch available per vendor advisory - AWS states the issue was remediated server-side with no customer action required, so no upgrade, redeployment, or configuration change is needed on the customer side. Defenders should review the AWS bulletin (https://aws.amazon.com/security/security-bulletins/2026-048-aws/) to confirm applicability, and as durable defense-in-depth ensure origin applications independently validate and sanitize input rather than relying solely on edge WAF inspection, since WAF is a compensating layer and not a substitute for application-level controls. If concerned about HTTP/2-specific smuggling generally, consider enabling origin-side request normalization and, where feasible, constraining or monitoring HTTP/2 body framing - with the trade-off that strict framing limits can affect legitimate clients using chunked or multi-frame uploads.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Security-policy bypass in the awslabs AWS API MCP Server (versions 0.2.13 through 1.3.46) lets an actor invoke AWS API o
OS command injection in the NodejsFunction local bundling pipeline of aws-cdk-lib prior to 2.245.0 (2.246.0 on Windows)
Same weakness CWE-444 – HTTP Request/Response Smuggling
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today