{"id":"CVE-2026-96437","kind":"vulnerability","aliases":["CVE-2026-96437"],"related":[],"title":"Kong Gateway: large request bodies bypass Azure AI content-safety checks","description":"The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks.","summary":"In Kong Gateway Enterprise, the ai-azure-content-safety plugin skips input checks on request bodies larger than the in-memory body buffer, so prompts in oversized requests reach the LLM unchecked (fails open, CWE-636). Kong's fix inspects bodies up to 10 MiB and rejects ones it cannot read.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Kong Gateway Enterprise","fixed":["3.13.0.12","3.14.0.11","3.15.0.4","3.16.0.1"],"affected":">= 3.13.0.0, < 3.13.0.12; >= 3.14.0.0, < 3.14.0.11; >= 3.15.0.0, < 3.15.0.4; >= 3.16.0.0, < 3.16.0.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-gateway","ai-tooling","azure-ai-content-safety","kong-gateway","llm","self-hosted"],"not_affected_if":["kong-oss","plugin-not-enabled"],"how_to_check":"Run 'kong version' on each node (Enterprise 3.13.0.0-3.13.0.11, 3.14.0.0-3.14.0.10, 3.15.0.0-3.15.0.3, 3.16.0.0 are affected). Then check whether any route, service or global config enables the ai-azure-content-safety plugin (guarding_mode INPUT or BOTH) in front of AI Proxy. If so, send a request larger than the in-memory body buffer containing text Azure should block and see whether it is rejected. The exact buffer setting is not named in the CVE record or the changelog; it is likely Nginx's client_body_buffer_size but that is unconfirmed.","fix":"Upgrade Kong Gateway Enterprise to 3.13.0.12, 3.14.0.11, 3.15.0.4 or 3.16.0.1 (or later; 3.16.0.2 is current). Kong's changelog says 3.13.0.12 now inspects request bodies up to 10 MiB and rejects unreadable ones.","status":"open","published_at":"2026-11-10T22:21:17+00:00","first_seen_at":"2026-11-10T22:27:31+00:00","triaged_at":"2026-11-10T22:29:02+00:00","updated_at":"2026-11-10T22:31:01+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-10T22:29:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kong Gateway: large request bodies bypass Azure AI content-safety checks","impact":"medium","summary":"The ai-azure-content-safety plugin in Kong Gateway Enterprise does not inspect request bodies larger than its in-memory buffer. Prompts sent in those oversized requests pass through without the content-safety check.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["kong-gateway","ai-gateway","azure-ai-content-safety","llm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"prompts reach the model without content-safety screening","analyst_note":"Find the affected and fixed Kong Gateway Enterprise versions and the plugin's buffer setting from the NVD entry or Kong's advisory.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-enabled"],"who_is_affected":"Teams running Kong Gateway Enterprise with the ai-azure-content-safety plugin enabled to screen LLM prompts. Installations without that plugin, or without Azure content safety in the request path, are not exposed. The sources do not give affected versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000692,"input_tokens":4525,"output_tokens":480,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Kong Gateway Enterprise versions and the plugin's buffer setting from the NVD entry or Kong's advisory.","search":"'-2026':14A,17A '-636':77B '-96437':15A,18A '10':85B 'ai':8A,23B,26B,30B,46B,95C 'ai-azure-content-safeti':45B,94C 'ai-gateway':22B 'ai-tool':25B 'allow':117C 'azur':7A,29B,47B,96C 'azure-ai-content-safeti':28B 'bodi':5A,56B,63B,82B,108C,115C 'buffer':64B,116C 'bypass':6A,120C 'cannot':91B 'check':12A,53B,125C 'content':10A,31B,48B,97C,123C 'content-safeti':9A,122C 'cve':13A,16A 'cwe':76B 'enterpris':43B,103C 'enterprise':21A 'fail':74B 'fix':80B 'gateway':2A,20A,24B,35B,42B,102C 'host':39B 'in-memori':60B,112C 'input':52B,121C 'inspect':81B,105C 'kong':1A,19A,34B,41B,78B,101C 'kong-gateway':33B 'larg':3A 'larger':57B,109C 'llm':36B,72B 'memori':62B,114C 'mib':86B 'one':89B 'open':75B 'overs':68B 'plugin':50B,99C 'prompt':66B,118C 'reach':70B 'read':92B 'reject':88B 'request':4A,55B,69B,107C 'safeti':11A,32B,49B,98C,124C 'self':38B 'self-host':37B 'skip':51B,104C 'tool':27B 'uncheck':73B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-managed or hybrid Kong Gateway Enterprise 3.13 to 3.16 with the ai-azure-content-safety plugin enabled for request (input) checking in front of AI Proxy. Anyone can send a large body to skip the filter, so it matters most if the filter is your only guardrail. Skip it if you do not use this plugin or run Kong OSS.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:31:01Z","by":"analyst","doc":"https://db.gcve.eu/search?assigner=Kong","run_id":2987}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["gatewayenterprise","konggatewayenterprise"],"ptokens":["enterprise","gateway","kong"],"labels":["aigateway","aitooling","azureaicontentsafety","high","konggateway","llm","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-96437':15A,18A 'ai':8A 'azur':7A 'bodi':5A 'bypass':6A 'check':12A 'content':10A 'content-safeti':9A 'cve':13A,16A 'enterprise':21A 'gateway':2A,20A 'kong':1A,19A 'larg':3A 'request':4A 'safeti':11A","search_b":"'-636':77B '10':85B 'ai':23B,26B,30B,46B 'ai-azure-content-safeti':45B 'ai-gateway':22B 'ai-tool':25B 'azur':29B,47B 'azure-ai-content-safeti':28B 'bodi':56B,63B,82B 'buffer':64B 'cannot':91B 'check':53B 'content':31B,48B 'cwe':76B 'enterpris':43B 'fail':74B 'fix':80B 'gateway':24B,35B,42B 'host':39B 'in-memori':60B 'input':52B 'inspect':81B 'kong':34B,41B,78B 'kong-gateway':33B 'larger':57B 'llm':36B,72B 'memori':62B 'mib':86B 'one':89B 'open':75B 'overs':68B 'plugin':50B 'prompt':66B 'reach':70B 'read':92B 'reject':88B 'request':55B,69B 'safeti':32B,49B 'self':38B 'self-host':37B 'skip':51B 'tool':27B 'uncheck':73B","search_c":"'ai':95C 'ai-azure-content-safeti':94C 'allow':117C 'azur':96C 'bodi':108C,115C 'buffer':116C 'bypass':120C 'check':125C 'content':97C,123C 'content-safeti':122C 'enterpris':103C 'gateway':102C 'in-memori':112C 'input':121C 'inspect':105C 'kong':101C 'larger':109C 'memori':114C 'plugin':99C 'prompt':118C 'request':107C 'safeti':98C,124C 'skip':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T22:21:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"02762ae7-200e-4b20-9b2b-a77d5b8fc4cb","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96437","severity":null,"published_at":"2026-11-10T22:21:17+00:00","modified_at":"2026-11-10T22:21:17+00:00","first_seen_at":"2026-11-10T22:27:31+00:00","fetched_at":"2026-11-10T22:27:31+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96437:2987","url":"https://developer.konghq.com/plugins/ai-azure-content-safety/changelog/","severity":null,"published_at":"2026-11-10T22:31:01+00:00","modified_at":"2026-11-10T22:31:01+00:00","first_seen_at":"2026-11-10T22:31:01+00:00","fetched_at":"2026-11-10T22:31:01+00:00","note":"Affected ranges from the Kong CNA CVE record (CVSS 4.0 8.2); 3.13.0.12 fix confirmed in Kong's plugin and gateway changelogs. Kong's changelog entries for 3.14.0.11/3.15.0.4/3.16.0.x do not mention this CVE, so those fixed versions rest on the CVE record only. Buffer setting name unconfirmed. No exploitation or PoC seen; social not searched.","cites":["https://developer.konghq.com/plugins/ai-azure-content-safety/changelog/","https://developer.konghq.com/gateway/changelog/","https://db.gcve.eu/search?assigner=Kong"]}],"documents":[{"id":119658,"url":"https://developer.konghq.com/plugins/ai-azure-content-safety/changelog/","title":"AI Azure Content Safety Plugin Changelog (Kong)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119284,"url":"https://developer.konghq.com/gateway/changelog/","title":"Kong Gateway changelog (3.16.0.2)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":119660,"url":"https://db.gcve.eu/search?assigner=Kong","title":"CVE-2026-96437 CVE record (Kong CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}