CVE-2026-96437
Received
Received - Intake
Kong Gateway Enterprise Content-Safety Bypass via Large Request Body
Vulnerability report for CVE-2026-96437, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-10
Last updated on: 2026-11-10
Assigner: Kong
Description
Description
The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Kong Inc. | Kong Gateway Enterprise | From 3.13.0.0 (inc) to 3.13.0.12 (exc) |
| Kong Inc. | Kong Gateway Enterprise | From 3.14.0.0 (inc) to 3.14.0.11 (exc) |
| Kong Inc. | Kong Gateway Enterprise | From 3.15.0.0 (inc) to 3.15.0.4 (exc) |
| Kong Inc. | Kong Gateway Enterprise | From 3.16.0.0 (inc) to 3.16.0.1 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-636 | When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions. |
