CVSS 3.1
4.0 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:NCVE-2026-26365
Medium (4.0). EPSS 0.2% chance of exploitation in the next 30 days.
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 10% of CVEs (scores of 2026-11-01)
- CWE
- CWE-444
- Published
- Modified
- Record from
- the NVD, synced