{"id":"CVE-2026-92441","aliases":[],"cve":{"records":[{"id":"CVE-2026-92441","source":"Kong","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-16T10:24:54.270Z","published":"2026-11-10T21:40:14.596Z","modified":"2026-11-13T14:31:40.161Z"}],"publishers":[{"name":"Kong","role":"CNA","organizationId":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","modified":"2026-11-10T21:40:14.596Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T14:31:40.161Z"}],"references":[{"url":"https://developer.konghq.com/gateway/changelog/","tags":["release-notes"],"source":"Kong"},{"url":"https://developer.konghq.com/ai-gateway/changelog/","tags":["release-notes"],"source":"Kong"}],"weaknesses":[{"id":"CWE-93","description":"CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')","source":"Kong"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T14:31:26.298323Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"yes"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes,…","titleSource":"Kong","descriptionSource":"Kong","description":"Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream.","score":7.8,"severity":"high","published":"2026-11-10T21:40:14.596Z","modified":"2026-11-13T14:31:40.161Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Kong Inc.","name":"Kong Gateway Enterprise","platforms":[],"versions":[{"version":"3.10.0.0","status":"affected","lessThan":"3.10.0.20","versionType":"custom"},{"version":"3.13.0.0","status":"affected","lessThan":"3.13.0.12","versionType":"custom"},{"version":"3.14.0.0","status":"affected","lessThan":"3.14.0.17","versionType":"custom"},{"version":"3.15.0.0","status":"affected","lessThan":"3.15.0.7","versionType":"custom"},{"version":"3.16.0.0","status":"affected","lessThan":"3.16.0.2","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-92441"},{"vendor":"Kong Inc.","name":"Kong AI Gateway","platforms":[],"versions":[{"version":"2.2.0","status":"affected","lessThan":"2.2.1","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Kong","url":"https://www.cve.org/CVERecord?id=CVE-2026-92441"}],"remediation":[],"references":["https://developer.konghq.com/gateway/changelog/","https://developer.konghq.com/ai-gateway/changelog/"],"sources":[{"name":"CVE","id":"CVE-2026-92441","modified":"2026-11-13T14:31:40.161Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-92441"}],"assessments":[{"source":"Kong","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7.8}],"sourceAffected":[],"observedAt":"2026-11-13T20:41:59.004Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:25:31.038Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-10T22:45:32.851Z","attemptedAt":"2026-11-10T22:45:32.851Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T22:45:33.271Z","attemptedAt":"2026-11-10T22:45:33.271Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T22:45:33.337Z","attemptedAt":"2026-11-10T22:45:33.337Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T22:45:32.837Z","attemptedAt":"2026-11-10T22:45:32.837Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-92441","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92441","modified":"2026-11-10T22:21:14.867","score":7.8,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-10T22:45:32.851Z"}],"aiSummary":{"text":"Kong Gateway Enterprise and Kong AI Gateway versions include decoded CR/LF characters in the X-Forwarded-Prefix header, allowing HTTP header injection and request smuggling. Affected versions include Kong Gateway Enterprise 3.10.0.0 to 3.10.0.19, 3.13.0.0 to 3.13.0.11, 3.14.0.0 to 3.14.0.16, 3.15.0.0 to 3.15.0.6, and 3.16.0.0 to 3.16.0.1, as well as Kong AI Gateway 2.2.0. The weakness is due to improper neutralization of CRLF sequences.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T22:41:06.008Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-92441"}]}}