CVE-2025-66373
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body with a chunk size different from the actual size, it may erroneously forward the invalid request and superfluous bytes to the origin server, allowing an attacker to hide a smuggled request.
Risk Assessment
This vulnerability could enable HTTP request smuggling, potentially leading to security bypass, cache poisoning, or unauthorized access. Organizations using Akamai CDN are exposed to such attacks.
Recommendation
Update Akamai Ghost configuration to a patched version (after 2025-11-17) or contact Akamai to apply mitigations. Monitor traffic for unusual chunked requests.
Other vulnerabilities in Akamai Ghost
Original NVD description (English source)
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS