Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
higress-group/higress
main @ 6d1c55c
19
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Denial of Service: 8 prior fixes. Scrutinize any change in this area.
plugins/wasm-go/extensions/ai-proxy: most-fixed (2 issues). Treat as high-risk during review.
10 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Attackers can bypass gateway authorization controls on downstream microservices by supplying a spoofed `X-HI-ORIGINAL-AUTH` header. This header was previously not stripped on the first hop, allowing external clients to override backend credentials.
Denial of Service: Unsafe handling of deferred HTTP operations (`proxywasm.ResumeHttpRequest`) combined with unhandled URL parsing errors leads to core proxy panics and crashes, causing complete service denial.
Auth Bypass: Bypasses in signature verification can occur when the gateway evaluates HMAC signatures over empty or dynamic headers. Failing to filter out empty header keys during string splitting allows attackers to manipulate signature payloads.