{"id":8925,"date":"2025-12-04T10:00:51","date_gmt":"2025-12-04T10:00:51","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/12\/04\/akamai-patches-http-request-smuggling-vulnerability-in-edge-servers\/"},"modified":"2025-12-04T10:00:51","modified_gmt":"2025-12-04T10:00:51","slug":"akamai-patches-http-request-smuggling-vulnerability-in-edge-servers","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/12\/04\/akamai-patches-http-request-smuggling-vulnerability-in-edge-servers\/","title":{"rendered":"Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers"},"content":{"rendered":"

Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A critical HTTP request smuggling vulnerability in Akamai\u2019s edge server infrastructure has been successfully fixed.<\/p>\n

The vulnerability, identified as CVE-2025-66373, stemmed from improper processing of HTTP requests<\/a> containing invalid chunk-encoded bodies, potentially exposing thousands of customers to sophisticated attacks.<\/p>\n

Understanding HTTP Chunked Transfer Encoding<\/strong><\/h2>\n

HTTP chunked transfer encoding is an HTTP\/1.1 standard that breaks message bodies into smaller chunks for efficient transmission. Each chunk consists of a size indicator followed by the corresponding data.<\/p>\n

Akamai\u2019s edge servers contained a flaw in how they processed malformed chunked requests. Specifically, those where the declared chunk size did not match the actual data size.<\/p>\n

When servers received such invalid requests, they incorrectly forwarded both the malformed request and superfluous data bytes to origin servers in certain conditions.<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n
Field<\/th>\nDetails<\/th>\n<\/tr>\n<\/thead>\n
CVE ID<\/strong><\/td>\nCVE-2025-66373<\/td>\n<\/tr>\n
Vulnerability Type<\/strong><\/td>\nHTTP Request Smuggling<\/td>\n<\/tr>\n
Affected Component<\/strong><\/td>\nAkamai Edge Servers<\/td>\n<\/tr>\n
Root Cause<\/strong><\/td>\nIncorrect processing of invalid chunk-encoded request bodies<\/td>\n<\/tr>\n
Severity Level<\/strong><\/td>\nHigh<\/td>\n<\/tr>\n
CVSS Score<\/strong><\/td>\n7.5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

This created an attack surface for HTTP Request Smuggling, a technique where attackers hide unauthorized requests within seemingly legitimate traffic<\/a>.<\/p>\n

An attacker exploiting this vulnerability could have concealed malicious requests within the extra bytes transmitted to origin servers.<\/p>\n

The practical exploitability depended on how individual origin servers processed the invalid requests they received from Akamai\u2019s infrastructure.<\/p>\n

However, the potential for abuse was significant, as successful smuggling attacks<\/a> could bypass security controls. Manipulate application logic, or execute unauthorized actions on behalf of legitimate users.<\/p>\n

Akamai detected the vulnerability on September 18, 2025. Following a two-month investigation and remediation period.<\/p>\n

The company deployed a complete fix on November 17, 2025, eliminating the vulnerability from all Akamai services globally. Notably, no customer action is required; the patch was applied transparently across the entire platform.<\/p>\n

The company formally disclosed this security issue through CVE-2025-66373 as part of its standard vulnerability disclosure process.<\/p>\n

Akamai<\/a> credited the security researcher for discovering and reporting the vulnerability through its Bug Bounty Program<\/a>.<\/p>\n

The coordinated disclosure exemplified responsible vulnerability management and demonstrated how collaborative security research strengthens the broader internet ecosystem.<\/p>\n

This patch reinforces Akamai\u2019s commitment to maintaining the security and reliability of its content delivery. An edge computing infrastructure, protecting millions of organizations worldwide from emerging threats.<\/p>\n

Follow us on Google News<\/a>, LinkedIn<\/a>, and X<\/a> for daily cybersecurity updates. Contact us<\/a> to feature your stories.<\/strong><\/p>\n

The post Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Abinaya
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers A critical HTTP request smuggling vulnerability in Akamai\u2019s edge server infrastructure has been successfully fixed. The vulnerability, identified as CVE-2025-66373, stemmed from improper processing of HTTP requests containing invalid chunk-encoded bodies, potentially exposing thousands of customers to sophisticated attacks. Understanding HTTP Chunked Transfer Encoding HTTP chunked […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-8925","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8925"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=8925"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/8925\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=8925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=8925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=8925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}