Description
Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| higress-group | higress | < 2.2.4 | 2.2.4 |
References
- GitHub Issue #4599 issue-tracking
- https://github.com/higress-group/higress product
- ExtractCookieValueByKey indexes kv[1] without checking the split length technical-description
- 2.2.4 uses SplitN with a length guard patch
- VulnCheck Advisory: Higress before 2.2.4 Rate Limit Bypass via Malformed Cookie Header third-party-advisory