CVE-2025-54142: Akamai Ghost HTTP Smuggling Vulnerability

CVE-2025-54142 Overview

CVE-2025-54142 is an HTTP Request Smuggling vulnerability affecting Akamai Ghost proxy servers before the 2025-07-21 release. The flaw allows attackers to smuggle requests through the persistent connection between an Akamai proxy and an origin server. Exploitation requires an OPTIONS request that carries an entity body, combined with an origin server that violates specific Internet standards regarding request handling. The weakness is classified under CWE-444, Inconsistent Interpretation of HTTP Requests.

Critical Impact
Successful exploitation enables request smuggling that can bypass proxy-layer security controls, poison caches, or route unauthorized requests to origin servers when specific origin-side standards violations exist.

Affected Products

Akamai Ghost proxy server versions released before 2025-07-21
Deployments where the origin server does not fully conform to HTTP/1.1 request handling standards
Persistent connection paths between Akamai edge and non-compliant origins

Discovery Timeline

2025-08-29 - CVE-2025-54142 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54142

Vulnerability Analysis

The vulnerability is an HTTP Request Smuggling issue rooted in how Akamai Ghost handles OPTIONS requests that include an entity body. HTTP Request Smuggling arises when two HTTP processors, in this case an Akamai proxy and an origin server, disagree on where one request ends and the next begins. Because Akamai Ghost maintains persistent connections to origin servers, a smuggled request can piggyback onto the connection and be interpreted as a distinct request by the origin.

The attack is only viable when the origin server violates certain Internet standards governing request parsing. The scope change reflected in the CVSS vector indicates that a successful smuggle can affect components beyond the immediately vulnerable one, such as other tenants sharing the origin connection pool.

Root Cause

The root cause is inconsistent HTTP request framing between Akamai Ghost and non-compliant origin servers. When an OPTIONS request carries an entity body, Akamai Ghost's parsing behavior can diverge from the origin's parsing behavior. A subsequent request embedded in the entity body is then treated as a separate request by the origin on the shared persistent connection.

Attack Vector

An attacker sends a crafted OPTIONS request with a carefully constructed body to the Akamai edge. The edge forwards the request over its persistent back-end connection to the origin. If the origin does not strictly follow HTTP standards for request boundaries, it interprets a portion of the body as a new request. The attacker can then influence responses served to unrelated users sharing the same connection or cache tier. The vulnerability is exploitable over the network without authentication, though attack complexity is high due to the required origin misbehavior.

No verified public proof-of-concept code is available. Refer to the Akamai Blog Security Advisory for vendor-supplied technical details.

Detection Methods for CVE-2025-54142

Indicators of Compromise

Unusual OPTIONS requests containing an entity body or a non-zero Content-Length header at edge or origin logs
Origin server logs showing back-to-back requests on the same persistent connection where the second request lacks a matching edge log entry
Cache poisoning symptoms such as unexpected responses served to unrelated clients
Anomalous mismatches between edge request counts and origin request counts on shared connections

Detection Strategies

Inspect HTTP traffic for OPTIONS methods carrying request bodies, which are uncommon in legitimate traffic
Correlate edge access logs with origin access logs to identify unaccounted-for requests
Enable strict HTTP/1.1 parsing at the origin and alert on request framing errors
Deploy a web application firewall (WAF) rule that flags OPTIONS requests with Content-Length greater than zero

Monitoring Recommendations

Log and alert on origin-side parser errors, particularly framing and boundary anomalies
Monitor for unexpected HTTP methods, headers, or paths appearing only in origin logs
Track connection reuse metrics between Akamai edge and origin for statistical anomalies
Review cache hit patterns for content served to unintended clients

How to Mitigate CVE-2025-54142

Immediate Actions Required

Confirm that Akamai has applied the 2025-07-21 or later Ghost update across your delivery configuration
Audit origin servers for strict compliance with HTTP/1.1 request framing standards
Review edge configurations for any custom handling of OPTIONS requests
Contact Akamai support to verify the fix is active for your account

Patch Information

Akamai deployed a fix in Ghost releases dated 2025-07-21 and later. Because Akamai Ghost is a managed edge platform, the vendor rolls the patch out to customers directly. Customers should confirm coverage via the Akamai Customer Update and the Akamai Blog Security Advisory.

Workarounds

Configure the origin server to reject OPTIONS requests that include an entity body
Enforce strict HTTP/1.1 conformance at the origin, including proper handling of Content-Length and Transfer-Encoding
Disable persistent connections between edge and origin where practical, accepting the performance trade-off
Add WAF rules at the origin to block malformed or standards-violating OPTIONS requests

bash

# Example WAF rule concept: block OPTIONS requests with a body at the origin
# NGINX example
if ($request_method = OPTIONS) {
    if ($http_content_length != "") {
        return 400;
    }
}