CVE-2026-92441: CRLF Injection

Published Nov 10, 2026

Updated

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex Routes, allowing HTTP header injection and request smuggling to the upstream.

Affected Software

2 affected components

kong Kong Gateway Enterprise

kong Kong AI Gateway

Event History

Nov 10, 2026

CVE Published

via MITRE·09:40 PM

Data Sourced

via MITRE·09:40 PM

DescriptionWeakness

Data Sourced

via NVD·10:21 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments should be prioritized for review?

Prioritize Kong Gateway Enterprise and Kong AI Gateway deployments that use regex Routes, especially where those routes proxy requests to sensitive upstream services.

What access does an attacker need?

The severity vector indicates exploitation can be performed over the network with low complexity, without authentication, privileges, or user interaction. The relevant request contains decoded CR/LF characters in the request path.

CVE-2026-92441: CRLF Injection

Affected Software

Event History

Frequently Asked Questions

Which deployments should be prioritized for review?

What access does an attacker need?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

What access does an attacker need?