Medium

HTTP Request Smuggling in Akamai Ghost CDN edge servers

IdentifiersCVE-2026-26365CWE-444· Inconsistent Interpretation of…

CVE-2026-26365 is an HTTP request smuggling vulnerability in Akamai Ghost on Akamai CDN edge servers prior to the fix deployed on 2026-02-06. Akamai Ghost mishandles processing of custom hop-by-hop HTTP headers. Specifically, an incoming request containing the header "Connection: Transfer-Encoding" can, depending on the Akamai processing path, cause the forwarded request to the origin server to use invalid or ambiguous HTTP message framing. This parser discrepancy can lead the origin server to interpret request boundaries differently from the Akamai edge, resulting in request desynchronization and HTTP request smuggling.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause the origin server behind Akamai to parse the request body incorrectly and become desynchronized from the Akamai edge. Depending on origin behavior and downstream controls, this can enable unintended request execution, request routing confusion, cache poisoning, and bypass of security controls that rely on consistent request framing and parsing between the CDN edge and the origin.

Mitigation

If you can’t patch tonight, do this now.

According to Akamai, no customer action is required because the fix was deployed across Akamai services. As a defense-in-depth measure, organizations can harden origin-side HTTP parsing by rejecting suspicious hop-by-hop header combinations such as "Connection: Transfer-Encoding", stripping or normalizing hop-by-hop headers at trusted ingress, and enforcing strict RFC-compliant framing rules so that only a single valid message framing mechanism is accepted.

Remediation

Patch, then assume compromise.

Akamai deployed a full fix on 2026-02-06 and stated that the vulnerability was completely eliminated from all Akamai services. Based on the provided content, no remediation action is required by customers. Where validation is desired, customers can confirm their traffic is handled by Akamai infrastructure incorporating the 2026-02-06 fix.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Akamai TechnologiesGhostapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

the hacker newsNews

Mar 2, 2026

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More

Unknown (listed as a trending CVE affecting Akamai).

the hacker newsNews

Mar 2, 2026

⚡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More

Unknown (listed as a trending CVE affecting Akamai; no technical details provided in the content).

akamaiNews

Feb 20, 2026

CVE-2026-26365: Incorrect processing of “Connection: Transfer-Encoding” | Akamai

A vulnerability in Akamai services that was fully fixed by Akamai before disclosure; customers do not need to take remediation action.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1