CVE-2026-92790
Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
| CWE | CWE-703 |
| Vendor | higress-group |
| Product | higress |
| Published | Sep 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for higress-group higress
Be the first to know when new medium vulnerabilities affecting higress-group higress are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
higress-group / higress
0 < 2.2.4
References
github.com: https://github.com/higress-group/higress/issues/4599 github.com: https://github.com/higress-group/higress github.com: https://github.com/higress-group/higress/blob/v2.2.3/plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go#L52-L63 github.com: https://github.com/higress-group/higress/blob/v2.2.4/plugins/wasm-go/extensions/ai-token-ratelimit/util/utils.go#L52-L63 vulncheck.com: https://www.vulncheck.com/advisories/higress-before-2.2.4-rate-limit-bypass-via-malformed-cookie-header
Credits
George Chen