CVE-2026-26365

{"id": "CVE-2026-26365", "cveTags": [{"tags": ["exclusively-hosted-service"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2026-02-23T09:17:01.210", "references": [{"url": "https://www.akamai.com/blog/security-research/cve-2026-26365-incorrect-processing-connection-transfer-encoding", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header \"Connection: Transfer-Encoding\" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling."}, {"lang": "es", "value": "Akamai Ghost en los servidores perimetrales de Akamai CDN antes del 2026-02-06 maneja incorrectamente el procesamiento de encabezados HTTP hop-by-hop personalizados, donde una solicitud entrante que contiene el encabezado 'Connection: Transfer-Encoding' podr\u00eda resultar en una solicitud reenviada con un encuadre de mensaje inv\u00e1lido, dependiendo de la ruta de procesamiento de Akamai. Esto podr\u00eda resultar en que el servidor de origen analice el cuerpo de la solicitud incorrectamente, lo que lleva al contrabando de solicitudes HTTP."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "cve@mitre.org"}