Skip to content
OpenAdvisories
High · 7.8 CVE-2026-92441 EUVD-2026-123054GHSA-r3xg-jh5p-8p5v

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on rege…

Published Nov 10, 2026 · Assigned by Kong

Vendor: Kong Product: Kong AI Gateway Product: Kong Gateway Enterprise

Description

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream.

Affected products

VendorProductAffectedFixed
Kong Kong Gateway Enterprise 3.10.0.0 – < 3.10.0.20, 3.13.0.0 – < 3.13.0.12, 3.14.0.0 – < 3.14.0.17, 3.15.0.0 – < 3.15.0.7, 3.16.0.0 – < 3.16.0.2 3.10.0.20
Kong Kong AI Gateway 2.2.0 – < 2.2.1 2.2.1

Advisories 1

References