CVE-2026-92790 Details
Description
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
A vulnerability in Higress AI Gateway versions prior to 2.2.4 allows unauthenticated attackers to bypass rate limiting by sending a malformed Cookie header segment without an equals sign. This flaw causes the application to panic while processing the Cookie, and the resulting error is improperly handled, allowing the request to proceed without the usual checks. As a consequence, attackers can exploit this to exceed rate limits designed to control expensive backend model calls, potentially leading to increased costs or resource exhaustion.
Users can update to Higress version 2.2.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/higress-group/higress/issues/4599 | CISA-ADP | ExploitIssue TrackingTechnical AnalysisVendor |
| https://github.com/higress-group/higress | [email protected] | Vendor |
| https://github.com/higress-group/higress/blob/v2.2.3/plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go#L52-L63 | [email protected] | |
| https://github.com/higress-group/higress/blob/v2.2.4/plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go#L52-L63 | [email protected] | |
| https://github.com/higress-group/higress/issues/4599 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/higress-before-2.2.4-rate-limit-bypass-via-malformed-cookie-header | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-703 | Improper Check or Handling of Exceptional Conditions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Higress | >= 0, < 2.2.4 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |