CVE-2025-66373

{
  "id": "CVE-2025-66373",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-04T17:15:56.867",
  "lastModified": "2026-11-04T22:10:00.210",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes to the origin server. An attacker could hide a smuggled request in these superfluous bytes. Whether this is exploitable depends on the origin server's behavior and how it processes the invalid request it receives from Akamai Ghost."
    },
    {
      "lang": "es",
      "value": "Akamai Ghost en los servidores perimetrales de Akamai CDN antes del 17-11-2025 tiene un error de procesamiento del cuerpo de solicitud fragmentado que puede resultar en contrabando de solicitudes HTTP. Cuando Akamai Ghost recibe un cuerpo fragmentado no válido que incluye un tamaño de fragmento diferente del tamaño real de los datos del fragmento siguiente, bajo ciertas circunstancias, Akamai Ghost reenvía erróneamente la solicitud no válida y los bytes superfluos subsiguientes al servidor de origen. Un atacante podría ocultar una solicitud contrabandeada en estos bytes superfluos. Si esto es explotable depende del comportamiento del servidor de origen y de cómo procesa la solicitud no válida que recibe de Akamai Ghost."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-08T16:22:23.543863Z",
          "id": "CVE-2025-66373",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:akamai:akamaighost:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2025-11-17",
              "matchCriteriaId": "EFD32023-12EE-4659-A1D5-ECA304F4EE92"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://en.wikipedia.org/wiki/HTTP_request_smuggling",
      "source": "[email protected]",
      "tags": [
        "Technical Description"
      ]
    },
    {
      "url": "https://www.akamai.com/blog/security/cve-2025-66373-http-request-smuggling-chunked-body-size",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}