https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T12:37:47.945870+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-331200 EUVD-2026-331200 2026-10-10T12:37:47.999730+00:00 EUVD-2026-331200 https://cve.radiocsirt.org/vuln/fkie_cve-2026-13763 fkie_cve-2026-13763 2026-10-10T12:37:47.999767+00:00

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups.

To remediate this issue, customers should enable the "Inspect after sufficient data" target group configuration associated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection )

 https://cve.radiocsirt.org/vuln/ghsa-9m3p-hghr-5v6c GHSA-9m3p-hghr-5v6c 2026-10-10T12:37:47.999805+00:00

Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups.

To remediate this issue, customers should enable the "Inspect after sufficient data" target group configuration associated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection )