Higress
Monthly
Higress gateways running the ai-token-ratelimit WASM plugin before version 2.2.4 allow unauthenticated remote clients to bypass AI token rate limiting by sending a Cookie header containing a segment without an equals sign; the resulting Go panic is recovered by the plugin wrapper, which then fails open and returns a continue action instead of blocking the request. The flaw is a fail-open control bypass rather than a confidentiality or code-execution issue: CVSS 4.0 scores it 6.9 (and the independent 3.1 assessment scores AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), because the only impact is that costly model backend calls can exceed configured thresholds, enabling cost and resource abuse, with no C or S impact. Exposure requires the ai-token-ratelimit plugin to be enabled on a network-reachable route - gateways without that plugin configured are not affected - and no public exploit code was identified at time of analysis.
Higress gateways running the ai-token-ratelimit WASM plugin before version 2.2.4 allow unauthenticated remote clients to bypass AI token rate limiting by sending a Cookie header containing a segment without an equals sign; the resulting Go panic is recovered by the plugin wrapper, which then fails open and returns a continue action instead of blocking the request. The flaw is a fail-open control bypass rather than a confidentiality or code-execution issue: CVSS 4.0 scores it 6.9 (and the independent 3.1 assessment scores AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), because the only impact is that costly model backend calls can exceed configured thresholds, enabling cost and resource abuse, with no C or S impact. Exposure requires the ai-token-ratelimit plugin to be enabled on a network-reachable route - gateways without that plugin configured are not affected - and no public exploit code was identified at time of analysis.