CVE-2026-92790

Name of the Vulnerable Software and Affected Versions Higress versions prior to 2.2.4

Description The software panics when processing a Cookie header segment that lacks an equals sign. This failure causes the plugin wrapper to recover and return a continue action, which allows the request to bypass AI token rate limiting. Unauthenticated attackers can exploit this by crafting a malformed Cookie header to skip rate limit checks and exceed the thresholds designed to restrict expensive model backend calls.

Recommendations Update to version 2.2.4 or later.