Higress versions prior to 2.2.4 improperly handle exceptional conditions when processing Cookie header segments lacking an equals sign. This improper handling causes the system to panic, triggering a recovery mechanism that inadvertently bypasses AI token rate limiting controls. As a result, unauthenticated attackers can send specially crafted malformed Cookie headers to circumvent rate limiting and potentially overwhelm costly model backend services by exceeding intended request thresholds.

The vulnerability allows unauthenticated attackers to bypass AI token rate limiting by exploiting a panic recovery triggered by malformed Cookie headers. This can lead to excessive backend calls, potentially causing resource exhaustion or degraded service performance. There is no indication of direct code execution or data breach, but the bypass of rate limiting can facilitate denial-of-service conditions or increased operational costs.

A fix is available in Higress version 2.2.4 and later. Users should upgrade to version 2.2.4 or newer to remediate this issue. Patch status is confirmed by the affectedVersions field indicating versions before 2.2.4 are vulnerable. No vendor advisory content was provided, so check the vendor's official channels for the patch and further guidance.