What happened
NVD published this CVSS 6.5 Medium finding on Sept 16, 2026: a malformed-input crash in Higress's rate-limiting plugin degrades to a fail-open state that skips AI token quota enforcement.
Why it matters
Rate limiting is often the only cost/abuse control between an AI gateway and expensive backend LLM inference; a trivially triggerable fail-open bypass lets any unauthenticated attacker exhaust token quotas or run up inference costs on behalf of legitimate tenants.
Attack vector
An unauthenticated attacker sends a Cookie header segment without an equals sign, causing the rate-limiting plugin to panic; the plugin wrapper recovers from the panic and returns a 'continue' action by default, which bypasses the AI token rate-limit check entirely and lets the attacker exceed configured usage thresholds.
Affected systems
Higress < 2.2.4
Mitigation
Upgrade to Higress >= 2.2.4; ensure plugin panic-recovery paths fail closed (deny) rather than fail open (continue) for security-relevant checks.