PT-2025-48787 · Akamai · Akamai

Published 2025-12-02 · Updated 2025-12-08 · CVE-2025-66373

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Akamai (affected versions not specified)

Description A flaw exists in Akamai that allows for HTTP request smuggling due to an invalid chunked body size. This issue, identified as a discrepancy between the chunk size and chunk data, enabled smuggled requests to be forwarded directly to the origin server. The vulnerability silently forwarded traffic for approximately two months before being addressed on November 17th. The issue involves the potential for malicious actors to inject requests into the HTTP traffic stream, potentially compromising the security of web applications and backend systems.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-66373

Affected Products

Akamai

References · 12

• https://osv.dev/vulnerability/CVE-2025-66373 · Vendor Advisory
• https://akamai.com/blog/security/cve-2025-66373-http-request-smuggling-chunked-body-size · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66373 · Security Note
• https://twitter.com/geeknik/status/1996355163947204785 · Twitter Post
• https://twitter.com/CVEnew/status/1996630582868996228 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1996684923411857452 · Twitter Post
• https://t.me/CVEtracker/38844 · Telegram Post
• https://t.me/cveNotify/145155 · Telegram Post
• https://en.wikipedia.org/wiki/HTTP_request_smuggling · Note
• https://twitter.com/ryancbarnett/status/1995992269657182423 · Twitter Post
• https://twitter.com/syedaquib77/status/1996822135784784166 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1pd86q1/cve202566373_http_request_smuggling_due_to · Reddit Post