Which versions of AWS Application Load Balancer are affected by EUVD-2026-40221?

AWS WAF managed rules on Application Load Balancers can be bypassed when processing HTTP/2 traffic through request fragmentation, allowing attackers to deliver malicious payloads directly to backend…

Is there a public PoC exploit available for EUVD-2026-40221?

Yes, a public proof-of-concept exploit is available for EUVD-2026-40221. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-40221?

Within 24 hours: Identify all Application Load Balancers with AWS WAF enabled serving HTTP/2 traffic and document WAF rule coverage for each target group. Within 7 days: Disable HTTP/2 on affected ALBs or implement backend request reassembly and body-content validation to reinspect fragmented payloads before processing; add secondary WAF rules at the application layer. Within 30 days: Subscribe to AWS security advisories and test patch availability; maintain enhanced logging for fragmented HTTP/2 frames to detect exploit attempts.

AWS Application Load Balancer EUVD-2026-40221

Q: What is the CVSS score of EUVD-2026-40221?

EUVD-2026-40221 has a CVSS 4.0 base score of 7.9 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-13763 HIGH

HTTP Request/Response Smuggling (CWE-444)

2026-06-29 AMZN

GHSA-9m3p-hghr-5v6c

Request Smuggling Authentication Bypass Aws Application Load Balancer

7.9

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

7.9 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.3 CRITICAL

Network, unauthenticated, low-complexity WAF bypass with scope change to the backend; integrity-high from smuggled content reaching the app, confidentiality low and availability not directly affected.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 20:32 vuln.today

Severity Changed

Jun 29, 2026 - 20:22 NVD

CRITICAL HIGH

CVSS changed

Jun 29, 2026 - 20:22 NVD

9.8 (CRITICAL) 7.9 (HIGH)

DescriptionCVE.org

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups.

To remediate this issue, customers should enable the "Inspect after sufficient data" target group configuration associated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection )

AnalysisAI

WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an HTTP/2 request body across multiple frames so that only a partial body is inspected before reaching the backend. The flaw (CWE-444, HTTP request smuggling) affects only ALB target groups serving HTTP/2 traffic with AWS WAF enabled, and lets attackers slip malicious payloads past WAF managed rules. No public exploit identified at time of analysis and it is not on CISA KEV; AWS scores it 7.9 (CVSS 4.0) with impact falling on the protected backend rather than the ALB itself.

Technical ContextAI

The vulnerability lives in how AWS WAF, when fronting an HTTP/2 ALB target group, reassembles and inspects request bodies that are delivered across multiple HTTP/2 DATA frames. HTTP/2 multiplexes requests into framed streams, and a body can legitimately be split across several DATA frames; here the inspection engine evaluates only a partial body before the backend reassembles the full message, producing the inconsistent-interpretation condition described by CWE-444 (Inconsistent Interpretation of HTTP Requests / request smuggling). The affected component per CPE is cpe:2.3:a:aws:aws_application_load_balancer:*, specifically the managed-rule body-inspection path. Because WAF and the backend disagree on what the 'request body' is, content the WAF never saw is still processed downstream - the classic frontend/backend desynchronization that underlies smuggling and security-control bypass.

RemediationAI

Patch available per vendor advisory in the form of a configuration remediation: enable the 'Inspect after sufficient data' target group attribute on the target group associated with the affected ALB, as documented at https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection, which forces WAF to buffer enough of the request body before inspection so fragmented bodies are fully evaluated. The trade-off is that buffering additional body data before passing it on can add latency and resource overhead for large request bodies, so validate performance on high-throughput endpoints. As an alternative or interim compensating control, restrict or disable HTTP/2 on affected target groups (forcing HTTP/1.x removes the fragmentation vector but loses HTTP/2 performance benefits), and review the full AWS bulletin at https://aws.amazon.com/security/security-bulletins/2026-048-aws/ for any account-specific guidance.