CVE-2026-92790 Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header
Unauthenticated attackers can bypass AI token rate limiting by sending a malformed Cookie header, allowing them to exceed usage thresholds on costly model backends.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-92790?
CVE-2026-92790 is a medium-severity vulnerability in higress-group higress, published on 16 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
Weakness: CWE-703
Which versions are affected by CVE-2026-92790?
How do I fix CVE-2026-92790?
No fix has been published for CVE-2026-92790 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-92790 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92790 exists.
Sources
Also known as GHSA-467c-wf8v-3rh9.