Tuesday, August 11, 2026
LIVEThe Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///The Unrelenting Cyber Battle: Hacking Threats and the Imperative of Robust Data Protection///Navigating the Cyber Labyrinth: Bolstering Defenses Against Evolving Hacking Threats///The Dual Front War: Battling Hacking and Bolstering Data Protection in the Digital Age///The Ever-Evolving Cyber Threat Landscape: Navigating Hacking and Fortifying Data Protection///The Unseen Battle: Fortifying Data in an Age of Relentless Hacking///The Unseen War: Hacking's Relentless Advance and the Imperative of Data Protection///The Evolving Threat Landscape: Hacking, Data Protection, and the Imperative for Proactive Security///Navigating the Digital Minefield: Bolstering Data Protection in an Era of Relentless Hacking///The Dual Fronts of Digital Defense: Combating Hacking and Fortifying Data Protection///Hacking's New Frontier: Fortifying Data Protection in the Age of Advanced Cyber Threats///The Dual Front: Navigating Hacking Threats and Fortifying Data Protection in the Digital Age///Navigating the Digital Gauntlet: The Evolving Nexus of Hacking and Data Protection///
Subscribe
Cyber Security
Independent · Digital
Thehackingpost
RSSSubscribe
CybersecurityAI-assisted

Akamai Patches HTTP Request Smuggling Vulnerability in Edge Servers

A critical vulnerability identified as CVE-2025-66373 in Akamai's edge server infrastructure has been resolved. This vulnerability was related to the improper handling of HTTP requests with invalid chunk-encoded bodies, potentially exposing customers to…

EBy Eric WallaceDec 04, 20251 min read

A critical vulnerability identified as CVE-2025-66373 in Akamai's edge server infrastructure has been resolved. This vulnerability was related to the improper handling of HTTP requests with invalid chunk-encoded bodies, potentially exposing customers to sophisticated attacks.

Understanding HTTP Chunked Transfer Encoding

HTTP chunked transfer encoding is an HTTP/1.1 standard that divides message bodies into smaller chunks for efficient transmission. Each chunk contains a size indicator followed by the actual data. The flaw in Akamai's edge servers involved processing malformed chunked requests where the declared chunk size did not match the actual data size.

Such invalid requests were incorrectly forwarded along with superfluous data bytes to origin servers under certain conditions, creating an attack surface for HTTP Request Smuggling. This technique allows attackers to hide unauthorized requests within legitimate traffic.

Field Details

CVE ID CVE-2025-66373

Vulnerability Type HTTP Request Smuggling

A critical vulnerability identified as CVE-2025-66373 in Akamai's edge server infrastructure has been resolved.
Eric Wallace · Thehackingpost

Affected Component Akamai Edge Servers

Root Cause Incorrect processing of invalid chunk-encoded request bodies

Severity Level High

CVSS Score 7.5

Advertisement

An attacker exploiting this vulnerability could have concealed malicious requests within the extra bytes transmitted to origin servers. The exploitability depended on how individual origin servers processed these invalid requests from Akamai's infrastructure. The potential for abuse was significant, as successful smuggling attacks could bypass security controls, manipulate application logic, or execute unauthorized actions on behalf of legitimate users.

Akamai detected the vulnerability on September 18, 2025, and deployed a complete fix on November 17, 2025, eliminating the vulnerability from all services globally. No customer action is required, as the patch was applied across the entire platform. The company disclosed this security issue through CVE-2025-66373 as part of its vulnerability disclosure process.

Akamai credited the security researcher who discovered and reported the vulnerability through its Bug Bounty Program, exemplifying responsible vulnerability management and strengthening the broader internet ecosystem. This patch reinforces Akamai's commitment to maintaining the security and reliability of its content delivery and edge computing infrastructure.

Based on reporting by Cyber Security News.

AI transparency. This article was produced with the assistance of artificial intelligence and published under human editorial oversight. AI systems can make mistakes. Read how we use AI (EU AI Act, Art. 50).
Related Stories
Cybersecurity

Why Fintech Banking Platforms Are Reducing Operational Costs by 40%

Paige Monroe · Mar 26, 2026
Cybersecurity

Dogecoin Price Prediction: SHIB Burns 172M Tokens as Pepeto Exchange Earns From Every Trade

Eric Wallace · Mar 26, 2026
Cybersecurity

Solana Price Prediction: SOL Holds $86 With Commodity Status as Pepeto Targets Bigger Returns

Zachary Burns · Mar 26, 2026
Cybersecurity

Open Directory Malware Campaign Uses Obfuscated VBS, PNG Loaders and RAT Payloads

Joseph Cain · Mar 26, 2026