CVE-2026-92790
Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header
CVSS 4.0 6.9 MEDIUMCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-92790
PublishedHigress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92790 · CVE overview and exploitation status
cve-program · CVE-2026-92790
- https://github.com/higress-group/higress/issues/4599
- https://github.com/higress-group/higress
- https://github.com/higress-group/higress/blob/v2.2.3/plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go#L52-L63
- https://github.com/higress-group/higress/blob/v2.2.4/plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go#L52-L63
- https://www.vulncheck.com/advisories/higress-before-2.2.4-rate-limit-bypass-via-malformed-cookie-header
Related changes
Linked by CVE identifierNo related changes are available here.