WAF Parsing Discrepancies and HTTP/2 Bypass: What the AWS CVE-2026-13762 Lesson Teaches

The short answer: even the largest cloud WAF can be bypassed by HTTP/2 multi-frame requests that cause the WAF to inspect only a partial body. AWS disclosed CVE-2026-13762 and CVE-2026-13763 in June 2026 — vulnerabilities in AWS WAF's HTTP/2 request body inspection that affected both CloudFront and Application Load Balancer deployments. The root cause is a parsing discrepancy: the WAF and the backend disagree on how to reassemble a multi-frame HTTP/2 request body. This is not an AWS-specific problem — it is a structural class of bypass that affects any WAF that inspects HTTP/2 traffic without fully accumulating data frames before inspection. This article explains the mechanism, the broader class of parsing discrepancies, and what to check in your own WAF.

What happened with AWS WAF and HTTP/2

AWS published security bulletin 2026-048-AWS on June 29, 2026, disclosing two CVEs:

• CVE-2026-13762: affects AWS WAF deployed with CloudFront. A crafted multi-frame HTTP/2 request could cause only a partial request body to be inspected by AWS WAF. This was remediated server-side; no customer action required.
• CVE-2026-13763: affects AWS WAF deployed with Application Load Balancer (ALB). Under certain conditions, a crafted multi-frame HTTP/2 request could cause only a partial request body to be inspected. This was addressed on ALB, and customers must configure WAF HTTP/2 traffic inspection behavior under target group attributes to enable full protection.

NVD classifies both under CWE-444: Inconsistent Interpretation of HTTP Requests — the same weakness class as HTTP request smuggling. The researcher credit goes to Kyungrok Choi, Woonghee Lee, and Junbeom Hur from Korea University ISSLab.

How HTTP/2 multi-frame bypass works

HTTP/2 uses binary framing: a request body is split into multiple DATA frames, each with its own length and flags. The WAF sits between the client and the backend, inspecting traffic. The bypass works when:

1. The client sends a malicious payload split across multiple HTTP/2 DATA frames.
2. The WAF inspects only the first frame (or a partial reassembly) and sees harmless content.
3. The backend reassembles all frames in order and receives the complete malicious payload.
4. The WAF and backend disagree on frame accumulation — the WAF did not wait for all frames before inspecting.

This is structurally identical to HTTP/1.1 request smuggling (CL.TE and TE.CL mismatches), where the frontend and backend disagree on request boundaries. The difference: HTTP/2's binary framing makes the discrepancy harder to detect and harder to test for.

The broader class: WAF parsing discrepancies

HTTP/2 multi-frame bypass is one instance of a wider problem. Security research published in 2026 catalogued 1,207 WAF parsing discrepancies across major WAF engines — differences in how WAFs interpret the same HTTP request compared to the backend application. The discrepancy classes include:

Why this is not just an AWS problem

• The vulnerability class is protocol-level, not vendor-specific. Any WAF that inspects HTTP/2 traffic without fully accumulating DATA frames before inspection is potentially vulnerable. AWS disclosed and fixed it; other vendors may have the same issue undisclosed.
• 1,207 documented discrepancies: the 2026 parsing discrepancy research shows this is widespread across WAF engines, not limited to one provider.
• HTTP/2 and HTTP/3 adoption is increasing: more traffic uses binary framing protocols, which increases the surface for frame-level parsing discrepancies.
• Coordinated disclosure is not universal: AWS disclosed responsibly. A WAF vendor that has not been tested by researchers like ISSLab may have the same bug, undiscovered and unpatched.

AWS WAF vs other providers: who discloses parsing bugs?

"Not publicly disclosed" does not mean "not vulnerable." It means the vendor has not been independently audited or has not self-disclosed. The AWS case shows that even the most resourced cloud WAF had this bug — assume others do too until proven otherwise.

Step-by-step: check your WAF for HTTP/2 parsing bypass

1. Identify your WAF deployment: which WAF engine, which CDN/load balancer, and whether HTTP/2 is enabled end-to-end (client → CDN → origin).
2. Check if your WAF accumulates HTTP/2 DATA frames before body inspection. For AWS ALB, verify the target group attribute for WAF HTTP/2 inspection is set to accumulate frames (the fix for CVE-2026-13763).
3. For non-AWS WAFs: ask your vendor directly whether they fully reassemble HTTP/2 request bodies before WAF inspection. If they cannot answer, treat the risk as open.
4. Test with a crafted multi-frame HTTP/2 request: split a known SQLi or XSS payload across two DATA frames and verify whether the WAF detects it. Tools like HTTP/2 test clients (h2c, curl --http2, or custom Go scripts) can do this.
5. Test with partial frames: send a frame with only part of a payload and the rest in a subsequent frame with END_STREAM flag. Check whether the WAF inspects the complete body or only the first frame.
6. Test content-type switching over HTTP/2: send the same payload as JSON, form-encoded, and multipart to see if the WAF parses all body types over HTTP/2 equally.
7. Review WAF logs: if the WAF logs the partial body as the full body, you have a frame-accumulation discrepancy.
8. Re-test after every WAF engine update and every HTTP/2 configuration change on your CDN or load balancer.

What else reduces parsing-discrepancy risk

• Full frame accumulation: require your WAF or load balancer to buffer all HTTP/2 DATA frames for a request before inspecting the body. This is the fix AWS implemented for ALB.
• Normalize at the edge: enforce a single canonical interpretation of HTTP/2 at your CDN or reverse proxy before traffic reaches the WAF, eliminating frame-boundary ambiguity.
• Inspect at the application layer too: never rely solely on the WAF for body inspection. Application-level input validation catches payloads that slip past a WAF parsing gap.
• Test for the 1,207 documented discrepancy patterns: if you have a test harness, include parsing-discrepancy test cases, not just payload variants.
• Monitor for request smuggling indicators: unexpected request routing, duplicate or partial requests in application logs, and timing anomalies can signal a parsing discrepancy in production.
• Keep WAF rules and engine updated: parsing bugs are fixed in engine updates, not just rule updates. Track your WAF engine version and patch promptly.

FAQ

Was AWS WAF the only WAF affected by this?

AWS is the only major provider that publicly disclosed and fixed an HTTP/2 multi-frame inspection bug (CVE-2026-13762/13763). Other vendors have not publicly disclosed similar issues, but "not disclosed" does not mean "not vulnerable." The vulnerability class is protocol-level and affects any WAF that does not fully accumulate HTTP/2 DATA frames before body inspection.

What is CWE-444 and why does it matter?

CWE-444 is "Inconsistent Interpretation of HTTP Requests" — the NVD classification for this vulnerability class. It covers request smuggling and any case where two components in the request path disagree on what the request means. It is the structural root of most WAF bypasses.

How do I know if my WAF has a parsing discrepancy?

You test it. Send crafted requests that exploit known discrepancy classes (HTTP/2 multi-frame, content-type switching, header normalization) and compare what the WAF sees versus what the application sees. If they disagree, you have a discrepancy. WAFNinja's 10 bypass technique families are a good starting checklist for what to test.

Is HTTP/2 more dangerous than HTTP/1.1 for WAF bypass?

Not more dangerous, but different. HTTP/2's binary framing introduces frame-accumulation discrepancies that did not exist in HTTP/1.1's text-based protocol. HTTP/1.1 has its own smuggling vectors (CL.TE, TE.CL). Both protocols have parsing-discrepancy risk; the specific attack vectors differ.

What should I do if my WAF vendor cannot answer whether they accumulate HTTP/2 frames?

Treat the risk as open and add compensating controls: application-layer input validation, request-body size limits, and behavioral detection that does not depend on WAF body inspection. Then pressure the vendor for an answer or evaluate a WAF that can.

Does WAFNinja cover HTTP/2-specific bypass techniques?

WAFNinja's published guides catalogue 10 WAF bypass technique families still relevant in 2026, including protocol-level and parsing-differential techniques. The HTTP/2 multi-frame bypass is a recent real-world instance of the parser-differential class that WAFNinja documents. Use WAFNinja's technique catalogue as a test checklist for your own deployment.

Sources and verification

Verified facts: AWS Security Bulletin 2026-048-AWS (June 29, 2026) discloses CVE-2026-13762 and CVE-2026-13763 — HTTP/2 multi-frame request body inspection issues in AWS WAF affecting CloudFront and ALB. NVD classifies both under CWE-444 (Inconsistent Interpretation of HTTP Requests). CVE-2026-13762 was fixed server-side; CVE-2026-13763 requires customer configuration of ALB target group HTTP/2 inspection attributes. Researcher credit: Kyungrok Choi, Woonghee Lee, Junbeom Hur (Korea University ISSLab). AWS ALB fix released May 22, 2026. Security research documenting 1,207 WAF parsing discrepancies was published in 2026 (source: WAF parsing discrepancy research, waf.is). WAFNinja catalogues 10 WAF bypass techniques still relevant in 2026 — WAFNinja guide, verified 2026-08-04. Claims about specific non-AWS vendors' HTTP/2 handling are marked pending verification — they have not been independently audited in public.