CVE-2026-92790

Overview

Higress API Gateway versions prior to 2.2.4 crash when encountering a Cookie header without an equals sign. The resulting panic is caught by the plugin wrapper, which mistakenly returns a continue action that bypasses AI token rate limiting, allowing unauthenticated users to exceed intended usage limits.

Description

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.

Impact

Unauthenticated attackers can bypass AI token rate limits, potentially exhausting backend resources, increasing operational costs, and causing service degradation. The vulnerability primarily impacts availability and cost control, with no direct confidentiality or integrity compromise.

Remediation

['Upgrade to Higress 2.2.4 or later, where the Cookie header parsing bug is fixed.', 'If an upgrade is not immediately possible, block or sanitize malformed Cookie headers at the network perimeter or within the gateway configuration.', 'Re‑enable or enforce AI token rate limiting policies to prevent abuse.']

Risk context

The CVSS v3 score of 6.5 indicates a medium severity risk. With no EPSS data, the urgency is driven by the potential for resource exhaustion and cost overrun rather than widespread exploitation. Prompt patching or mitigation is recommended to maintain service stability.

Affected products

• Higress
• Higress API Gateway