Threats affecting pkg:github/higress-group/higress

CVE-2026-92790 is a vulnerability in Higress versions before 2.2.4 where the software panics when processing a Cookie header segment lacking an equals sign. This causes the plugin wrapper to recover by returning a continue action that bypasses AI token rate limiting. As a result, unauthenticated attackers can craft malformed Cookie headers to skip rate limit checks and exceed thresholds designed to restrict costly backend model calls.