PT-2026-21505 · Akamai · Akamai

Published 2026-02-23 · Updated 2026-02-23 · CVE-2026-26365

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Akamai versions prior to 2026-02-06

Description The software mishandles processing of custom hop-by-hop HTTP headers. An incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could lead to HTTP request smuggling, potentially causing the origin server to parse the request body incorrectly.

Recommendations Update to a version released on or after 2026-02-06.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2026-26365

Affected Products

Akamai

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-26365 · Security Note
• https://t.me/CVEtracker/45486 · Telegram Post
• https://akamai.com/blog/security-research/cve-2026-26365-incorrect-processing-connection-transfer-encoding · Note
• https://twitter.com/CVEnew/status/2025892033936671090 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2025877313708003484 · Twitter Post