Akamai deployed a complete fix for a critical HTTP Request Smuggling vulnerability affecting its edge servers.
The flaw stemmed from incorrect handling of malformed HTTP/1.1 requests that used chunked transfer encoding, potentially allowing attackers to smuggle hidden requests to origin servers behind Akamai.
Technical background
In HTTP/1.1, chunked transfer encoding allows a message body to be sent in multiple chunks. Each chunk begins with a hexadecimal chunk size, followed by exactly that many bytes of chunk data, and finally a terminating zero-length chunk marks the end of the body.
If implemented correctly, any mismatch between the declared size and the actual data should cause the request to be rejected.
Akamai’s edge platform contained a logic error in this processing path. When an edge server received a request whose chunked body was invalid for example, a chunk size that did not match the actual size of the following data the edge did not always terminate or sanitize the request.
Under certain circumstances, it would forward the malformed request, along with extra, superfluous bytes, to the origin server.
Those superfluous bytes created an opportunity for HTTP Request Smuggling. An attacker could craft a front-end request where the visible portion looked invalid or harmless, but the extra bytes contained a second, hidden HTTP request.
If the origin server parsed the forwarded stream differently from Akamai, it might interpret those hidden bytes as a separate request.
This desynchronization between the edge and the origin could enable classic request smuggling scenarios, including:
- Bypassing security controls or request filters at the edge
- Impersonating other users or poisoning intermediate caches
- Delivering unauthorized requests to internal applications
Whether the flaw was practically exploitable depended entirely on how the specific origin server handled malformed chunked bodies and trailing bytes.
Some origins would reject such input outright, while others might parse and execute the smuggled request, increasing the risk.
Akamai first became aware of the issue on September 18, 2025. After investigation and remediation work, a full fix was deployed globally on November 17, 2025, removing the vulnerable behavior from all Akamai services.
The updated logic correctly handles invalid chunked bodies and prevents any superfluous bytes from being forwarded in a way that could carry a smuggled request.
Akamai reports that no customer action is required, as the patch was applied platform-wide. The issue has been disclosed under the identifier CVE-2025-66373, aligning with standard vulnerability reporting practices and enabling customers and tools to track the flaw.
| CVE ID | Description | CVSS (Base) | Severity | Affected Component | Status |
|---|---|---|---|---|---|
| CVE-2025-66373 | HTTP Request Smuggling via invalid chunked body handling in edge servers | To be assigned | To be assigned | Akamai edge HTTP request parsing | Patched as of 2025-11-17 |
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=The flaw stemmed from incorrect handling of malformed HTTP/1.1 requests that used chunked transfer encoding, potentially allowing attackers){kind=link}