---
id: "CVE-2026-96437"
page: "https://infrastack.ai/live/CVE-2026-96437"
kind: "vulnerability"
aliases: ["CVE-2026-96437"]
title: "Kong Gateway: large request bodies bypass Azure AI content-safety checks"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Kong Gateway Enterprise", "fixed": ["3.13.0.12", "3.14.0.11", "3.15.0.4", "3.16.0.1"], "affected": ">= 3.13.0.0, < 3.13.0.12; >= 3.14.0.0, < 3.14.0.11; >= 3.15.0.0, < 3.15.0.4; >= 3.16.0.0, < 3.16.0.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-gateway", "ai-tooling", "azure-ai-content-safety", "kong-gateway", "llm", "self-hosted"]
not_affected_if: ["kong-oss", "plugin-not-enabled"]
published_at: "2026-11-10T22:21:17+00:00"
first_seen_at: "2026-11-10T22:27:31+00:00"
updated_at: "2026-11-10T22:31:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96437", "first_seen_at": "2026-11-10T22:27:31+00:00"}, {"source": "analyst", "url": "https://db.gcve.eu/search?assigner=Kong", "first_seen_at": "2026-11-10T22:31:01+00:00", "cites": ["https://db.gcve.eu/search?assigner=Kong", "https://developer.konghq.com/plugins/ai-azure-content-safety/changelog/", "https://developer.konghq.com/gateway/changelog/"]}]
exploit_sources: []
---

# Kong Gateway: large request bodies bypass Azure AI content-safety checks

Link for people: https://infrastack.ai/live/CVE-2026-96437 (this .md is for agents)

In Kong Gateway Enterprise, the ai-azure-content-safety plugin skips input checks on request bodies larger than the in-memory body buffer, so prompts in oversized requests reach the LLM unchecked (fails open, CWE-636). Kong's fix inspects bodies up to 10 MiB and rejects ones it cannot read.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kong Gateway Enterprise affected >= 3.13.0.0, < 3.13.0.12; >= 3.14.0.0, < 3.14.0.11; >= 3.15.0.0, < 3.15.0.4; >= 3.16.0.0, < 3.16.0.1 fixed 3.13.0.12, 3.14.0.11, 3.15.0.4, 3.16.0.1

## How to check

Run 'kong version' on each node (Enterprise 3.13.0.0-3.13.0.11, 3.14.0.0-3.14.0.10, 3.15.0.0-3.15.0.3, 3.16.0.0 are affected). Then check whether any route, service or global config enables the ai-azure-content-safety plugin (guarding_mode INPUT or BOTH) in front of AI Proxy. If so, send a request larger than the in-memory body buffer containing text Azure should block and see whether it is rejected. The exact buffer setting is not named in the CVE record or the changelog; it is likely Nginx's client_body_buffer_size but that is unconfirmed.

## Fix

Upgrade Kong Gateway Enterprise to 3.13.0.12, 3.14.0.11, 3.15.0.4 or 3.16.0.1 (or later; 3.16.0.2 is current). Kong's changelog says 3.13.0.12 now inspects request bodies up to 10 MiB and rejects unreadable ones.

## Timeline

- 2026-11-10T22:27:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96437
- 2026-11-10T22:31:01+00:00 analyst https://db.gcve.eu/search?assigner=Kong — Affected ranges from the Kong CNA CVE record (CVSS 4.0 8.2); 3.13.0.12 fix confirmed in Kong's plugin and gateway changelogs. Kong's changelog entries for 3.14.0.11/3.15.0.4/3.16.0.x do not mention this CVE, so those fixed versions rest on the CVE record only. Buffer setting name unconfirmed. No exploitation or PoC seen; social not searched.

## Documents

- [advisory] CVE-2026-96437 CVE record (Kong CNA) https://db.gcve.eu/search?assigner=Kong
- [fix] AI Azure Content Safety Plugin Changelog (Kong) https://developer.konghq.com/plugins/ai-azure-content-safety/changelog/
- [fix] Kong Gateway changelog (3.16.0.2) https://developer.konghq.com/gateway/changelog/

## From the sources

The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allowing prompts to bypass input content-safety checks.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_