PT-2026-21505 · Akamai · Akamai

Publicado 2026-02-23 · Atualizado 2026-02-23 · CVE-2026-26365

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Akamai versions prior to 2026-02-06

Description The software mishandles processing of custom hop-by-hop HTTP headers. An incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could lead to HTTP request smuggling, potentially causing the origin server to parse the request body incorrectly.

Recommendations Update to a version released on or after 2026-02-06.

Correção

HTTP Request/Response Smuggling

Enumeração de Fraquezas

CWE-444

Identificadores relacionados

CVE-2026-26365

Produtos afetados

Akamai

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-26365 · Nota de Segurança
• https://t.me/CVEtracker/45486 · Publicação no Telegram
• https://akamai.com/blog/security-research/cve-2026-26365-incorrect-processing-connection-transfer-encoding · Nota
• https://twitter.com/CVEnew/status/2025892033936671090 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/2025877313708003484 · Publicação no Twitter