AWS Application Load Balancer EUVD-2026-40221

Exploitation requires that the target be an AWS ALB with AWS WAF enabled AND serving an HTTP/2 target group - HTTP/1.x target groups are explicitly not affected. The attacker must send HTTP/2 requests that fragment the request body across multiple DATA frames so only a partial body is inspected by WAF managed rules. No authentication is required (PR:N) and no user interaction (UI:N), and the request is sent remotely over the network (AV:N) at low complexity (AC:L/AT:N). The key limiting factors are: (1) the deployment must use HTTP/2 target groups, (2) WAF managed-rule body inspection must be relied upon for protection, (3) the 'Inspect after sufficient data' attribute must NOT be enabled, and (4) realized impact depends on there being an exploitable vulnerability on the backend that the bypassed WAF rule would otherwise have blocked.

AWS's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated condition with no special attack requirements, which favors exploitability. Notably the vector assigns no impact to the vulnerable system itself (VC:N/VI:N/VA:N) but high impact to subsequent systems (SC:H/SI:H/SA:H), correctly modeling this as a security-control bypass whose damage materializes on the protected backend rather than the ALB - this is why the score lands at 7.9 rather than a perfect 10. No EPSS score was provided, there is no POC in the supplied data, and it is not listed in CISA KEV, so all three exploitation-likelihood signals are currently absent or low. The real-world severity is therefore conditional: the WAF bypass is only as dangerous as the vulnerability it lets through to the backend, so an attacker still needs an exploitable flaw behind the WAF for the high subsequent-system impact to be realized. Net: a genuine and easily triggered control-bypass on a very widely deployed platform, but its impact is contingent on backend exposure, and the absence of EPSS/KEV/POC suggests it is not yet a mass-exploited priority.

An attacker targets a public web application sitting behind an HTTP/2-enabled ALB with AWS WAF managed rules, and sends a crafted HTTP/2 request that splits a malicious payload (e.g., a SQL injection or command string) across multiple DATA frames so WAF inspects only the harmless leading fragment. The full reassembled body - including the malicious portion WAF never saw - reaches the backend application and is processed, defeating the managed-rule protection. No public POC is identified in the available data, but the low attack complexity (AC:L, AT:N) means the crafting is straightforward for an actor familiar with HTTP/2 framing.