CVE-2026-92790: Higress-Group Higress

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.

Affected products

• Higress-Group Higress: before 2.2.4 (fixed in 2.2.4)

Published 2026-09-16. Last modified 2026-09-24.