[Under Evaluation – CVE-2026-13763]: In AWS Application Load Balancer with AWS WAF enabled, inconsistent HTTP/2 request parsing lets remote attackers bypass WAF managed rule body inspection by fragmenting the request body across HTTP/2 frames so only a partial body is inspected. Affects HTTP/2 ALB target groups. Fix: Enable the target group setting Inspect after sufficient data.