CVE-2026-92790 in Higress
Summary
by MITRE • 09/16/2026
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Higress versions prior to 2.2.4 represents a critical failure in input validation within the HTTP request processing pipeline, specifically targeting the parsing logic for Cookie headers. The core technical flaw stems from an improper handling of malformed header segments that lack the standard key-value delimiter, typically an equals sign. In compliant HTTP implementations and robust proxy architectures like Higress, cookie strings are expected to follow a specific format where each segment consists of a name followed by an equals sign and then a value. When the parser encounters a segment devoid of this separator, it fails to execute correctly, leading to a runtime panic within the Go-based service mesh control plane or data plane components responsible for header inspection. This crash is not merely a denial-of-service vector in itself but serves as a mechanism that triggers an automatic recovery routine designed to maintain system stability during unexpected errors.
The operational impact of this vulnerability extends far beyond simple service instability, primarily due to the behavior of the plugin wrapper upon detecting such anomalies. Instead of rejecting the malformed request or returning an error code indicative of bad input, the recovery logic defaults to a continue action. This default behavior effectively bypasses subsequent security plugins and middleware that rely on successful header parsing to function correctly. In this specific context, the affected component is responsible for enforcing AI token rate limiting policies. These policies are critical controls designed to prevent abuse of expensive machine learning model backends by restricting the volume or frequency of requests from any single source. By triggering a panic followed by an automatic recovery that continues request processing without validation, attackers can effectively nullify these protective measures.
Unauthenticated actors can exploit this flaw by crafting HTTP requests containing Cookie headers with segments missing the equals sign separator. Because the vulnerability does not require authentication to trigger, it presents a significant risk to any publicly accessible Higress deployment utilizing AI proxying capabilities. The attacker sends a specially crafted request that causes the parser to panic, which in turn forces the system into its recovery state where rate limiting checks are skipped entirely. This allows the malicious traffic to pass through the gateway and reach the backend AI services without being throttled or blocked by existing security policies. Consequently, this leads to potential resource exhaustion of the model inference engines, increased operational costs for organizations relying on pay-per-use AI APIs, and a degradation of service availability for legitimate users who are subject to normal rate limits.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system fails to adequately sanitize or verify the structure of incoming HTTP headers before processing them within critical security logic. Furthermore, it relates to CWE-754 Improper Check for Unusual or Exceptional Conditions, where the error handling mechanism inadvertently creates a bypass path rather than enforcing strict failure semantics. In terms of offensive tactics, this exploitation technique maps to MITRE ATT&CK T1190 Exploit Public-Facing Application and specifically leverages T1625 Lack of Rate Limiting to overwhelm backend resources or incur financial damage through API abuse. The attack vector is classified as Network-based with Low Complexity, requiring only the ability to send HTTP requests to the target service without prior authentication.
Mitigation strategies must focus on immediate version upgrades and defensive configuration adjustments. The primary remediation step is to upgrade Higress to version 2.2.4 or later, where the parsing logic has been hardened to handle malformed headers gracefully without triggering panics that bypass security controls. Organizations should also implement strict input validation at the edge of their network using Web Application Firewalls configured to reject HTTP requests with non-compliant header formats before they reach the Higress ingress controller. Additionally, deploying rate limiting mechanisms at multiple layers, including application-level limits independent of the gateway plugin wrapper, can provide defense in depth against this specific bypass technique. Monitoring logs for panic stack traces or unusual spikes in backend AI model usage can aid in early detection and response to potential exploitation attempts.