Akamai Ghost HTTP Request Smuggling Vulnerability via Custom Hop-by-Hop Headers

A vulnerability in Akamai Ghost on Akamai CDN edge servers prior to 2026-02-06 allows for HTTP request smuggling. This issue arises from the improper handling of custom hop-by-hop HTTP headers. When a request includes the 'Connection: Transfer-Encoding' header, it can lead to a forwarded request with incorrect message framing. Depending on the Akamai processing path, this could cause the origin server to misinterpret the request body, facilitating HTTP request smuggling.

Impact

Exploitation of this vulnerability could lead to HTTP request smuggling, a technique that manipulates the way HTTP requests are processed, potentially causing the server to misinterpret the request body or headers.