CVE-2025-66373 is a vulnerability affecting Akamai Ghost, the software running on Akamai CDN edge servers prior to November 17, 2025. The flaw arises from incorrect processing of HTTP chunked transfer encoding in request bodies. When Akamai Ghost receives a chunked request where the declared chunk size does not match the actual size of the chunk data, it erroneously forwards the invalid request along with additional superfluous bytes to the origin server. This forwarding behavior can be exploited to perform HTTP request smuggling attacks, where an attacker crafts a malicious request hidden within the extra bytes forwarded by Akamai Ghost. HTTP request smuggling can lead to various attacks such as bypassing security controls, cache poisoning, cross-user data leakage, and web application firewall evasion. The actual exploitability depends on how the origin server interprets and processes the malformed requests forwarded by Akamai Ghost. Since Akamai CDN is widely used to accelerate and secure web traffic, this vulnerability could have broad implications. No patches or exploits are currently publicly available, and no CVSS score has been assigned yet. The vulnerability was reserved on November 28, 2025, and published on December 4, 2025.

For European organizations, this vulnerability poses a significant risk due to Akamai's extensive CDN presence in Europe, where many enterprises and government agencies rely on Akamai for content delivery and security. If exploited, attackers could smuggle malicious HTTP requests past edge defenses, potentially leading to unauthorized access, data leakage, session hijacking, or manipulation of web application behavior. This could compromise confidentiality and integrity of sensitive data and disrupt availability through targeted attacks. Organizations with origin servers that do not properly validate or reject malformed chunked requests are particularly vulnerable. The impact is amplified for sectors with critical infrastructure or sensitive data, such as finance, healthcare, and government services. Additionally, the stealthy nature of HTTP request smuggling makes detection and mitigation challenging, increasing the risk of prolonged undetected exploitation.

Organizations should monitor Akamai's official communications for patches or updates addressing this vulnerability and apply them promptly once available. In the interim, review and harden origin server configurations to ensure strict validation of chunked transfer encoding and reject malformed HTTP requests. Implement logging and monitoring to detect anomalies indicative of request smuggling attempts, such as unexpected request lengths or duplicated headers. Employ Web Application Firewalls (WAFs) with updated signatures capable of detecting HTTP request smuggling patterns. Conduct security assessments and penetration testing focused on HTTP request smuggling to identify and remediate weaknesses. Collaborate with Akamai support to understand any recommended configuration changes or temporary mitigations. Finally, educate security teams about the nature of HTTP request smuggling to improve incident response readiness.