CVE-2026-26365: Medium severity Akamai Akamai CDN vulnerability
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-26365?
CVE-2026-26365 is considered a moderate severity vulnerability due to its potential impact on message framing.
How do I fix CVE-2026-26365?
To mitigate CVE-2026-26365, ensure that your Akamai CDN is updated to a version released on or after 2026-02-06.
What systems are affected by CVE-2026-26365?
CVE-2026-26365 affects Akamai CDN edge servers prior to the patch released on 2026-02-06.
What kind of issues can CVE-2026-26365 cause?
CVE-2026-26365 can lead to invalid message framing in forwarded requests, potentially disrupting communication.
Is CVE-2026-26365 being actively exploited?
As of now, there are no reported active exploits for CVE-2026-26365, but it is advisable to address the vulnerability promptly.