CVE-2025-66373: Medium severity Akamai Ghost vulnerability
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-66373?
CVE-2025-66373 is classified as a medium to high severity vulnerability due to its potential for HTTP request smuggling.
How do I fix CVE-2025-66373?
To mitigate CVE-2025-66373, upgrade Akamai Ghost and Akamai CDN edge servers to versions released after November 17, 2025.
What can exploit CVE-2025-66373?
CVE-2025-66373 can be exploited by attackers sending crafted HTTP requests with malformed chunk sizes.
What are the potential impacts of CVE-2025-66373?
The potential impacts of CVE-2025-66373 include data breaches and unauthorized access due to HTTP request smuggling.
Who is affected by CVE-2025-66373?
CVE-2025-66373 affects all users utilizing Akamai Ghost and Akamai CDN edge servers prior to the specified patch date.