Vulnerability · Published Sep 16, 2026 · Assigned by VulnCheck
CVE-2026-92790Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header
Medium 6.5
In plain English
A medium-severity security flaw in higress from higress-group. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.5%top 55.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| higress-group | higress | 0 – before 2.2.4 |
Weakness: CWE-703 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- GitHub Issue #4599 issue-tracking
- https://github.com/higress-group/higress product
- ExtractCookieValueByKey indexes kv[1] without checking the split length technical-description
- 2.2.4 uses SplitN with a length guard patch
- VulnCheck Advisory: Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header third-party-advisory