Amazon CloudFront, when coupled with AWS WAF, misinterpreted fragmented HTTP/2 request bodies, causing only a portion of the payload to be examined by managed rulebody inspection. This oversight permits remote actors to submit malicious content that evades all relevant WAF checks, potentially enabling payload delivery and subsequent exploitation of downstream services. The flaw corresponds to CWE‑444, reflecting a failure in secure parsing of network input.

The affected system is Amazon CloudFront with AWS WAF enabled. No specific product version information is enumerated, implying that all currently deployed instances of CloudFront using WAF are impacted. Because the remediation was performed server‑side, no customer‑specific changes to CloudFront configuration are necessary.

The CVSS score of 7.9 denotes a high severity risk, while the EPSS score is currently unavailable, indicating limited data on exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote, internet‑based attacker sending crafted HTTP/2 requests to the CloudFront distribution; this inference is derived from the description’s mention of remote actors.