CVE Explorer

CVE-2025-66373

Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether t

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:b45b61b2a9931f3e59144813e2586666a0fa223af418142dcc8e1cbe6f776afd

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-444","description":"CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/adp/0/problemTypes/0/descriptions/0

{"description":"n/a","lang":"en","type":"text"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.8,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/adp/0/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-444","description":"CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/adp/0/problemTypes/0/descriptions/0

{"description":"n/a","lang":"en","type":"text"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/cna/problemTypes/0/descriptions/0

Source references

2 source assertions

{"url":"https://en.wikipedia.org/wiki/HTTP_request_smuggling"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/cna/references/0

{"url":"https://www.akamai.com/blog/security/cve-2025-66373-http-request-smuggling-chunked-body-size"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:c527473b49dcc5a0b07fa4d6f872c26b8023b96aee1b1f515e215551d3da1f9b · sha256:48d6f8b4c4eeab81… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer