CVE-2026-92790 in Higress
Riassunto
di MITRE • 16/09/2026
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.