CVE-2025-54142

MediumCVSS 4.0

Published: 29/08/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request with an entity body, because a subsequent request can occur within the persistent connection between an Akamai proxy server and an origin server if the origin server violates certain Internet standards.

Risk Assessment

This may allow an attacker to smuggle requests and bypass security controls, leading to unauthorized access or cache poisoning.

Recommendation

Update Akamai Ghost to version 2025-07-21 or later and verify origin server compliance with standards.

Other vulnerabilities in Akamai Ghost

CVE-2025-66373Medium
Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body with a chunk size different from the actual size, it may erroneously forward the invalid request and superfluous bytes to the origin server, allowing an attacker to hide a smuggled request.

Original NVD description (English source)

Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS