CVE-2025-54142

Published Aug 29, 2025

Last updated 3 days ago

CVSS medium 4.0
HTTP

Overview

Description
Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the persistent connection between an Akamai proxy server and an origin server, if the origin server violates certain Internet standards.
Source
cve@mitre.org
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
4
Impact score
1.4
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Severity
MEDIUM

Weaknesses

cve@mitre.org
CWE-444

Social media

Hype score
Not currently trending

  1. Learn how @Akamai InfoSec mitigated CVE-2025-54142 — an HTTP request smuggling vulnerability arising from OPTIONS requests with a body. Read more. #AkamaiSecurity https://t.co/2S9rfxmVxV https://t.co/f3S6l30Mly

    @epichol

    12 Sept 2025

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Akamai InfoSec mitigated CVE-2025-54142 — an HTTP request smuggling vulnerability arising from OPTIONS requests with a body. Read more. https://t.co/bRqI8OFCbd https://t.co/yRr696j9Ot

    @Akamai

    6 Sept 2025

    807 Impressions

    1 Retweet

    3 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  3. Learn how @Akamai InfoSec mitigated CVE-2025-54142 — an HTTP request smuggling vulnerability arising from OPTIONS requests with a body. Read more. #AkamaiSecurity https://t.co/gINH6dgL50 https://t.co/fpQ4eLJ72T

    @claytonssantos

    2 Sept 2025

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Learn how @Akamai InfoSec mitigated CVE-2025-54142 — an HTTP request smuggling vulnerability arising from OPTIONS requests with a body. Read more. #AkamaiSecurity https://t.co/KjL1WH0OyO https://t.co/EARUs0NtxR

    @RaghuNain

    1 Sept 2025

    42 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Learn how @Akamai InfoSec mitigated CVE-2025-54142 — an HTTP request smuggling vulnerability arising from OPTIONS requests with a body. Read more. #AkamaiSecurity https://t.co/uA5UdF7SdW https://t.co/4MYX5ev84n

    @AngeloAkamai

    1 Sept 2025

    49 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Learn how @Akamai InfoSec mitigated CVE-2025-54142 — an HTTP request smuggling vulnerability arising from OPTIONS requests with a body. Read more. #AkamaiSecurity https://t.co/zbhI5Sqa1i https://t.co/S34o0M6L42

    @Jrenou

    29 Aug 2025

    37 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-54142 Akamai Ghost before 2025-07-21 allows HTTP Request Smuggling via an OPTIONS request that has an entity body, because there can be a subsequent request within the pers… https://t.co/c0v7U1Gpf3

    @CVEnew

    29 Aug 2025

    338 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser while building an error message for a malformed response. An attacker controlled server, or possibly an accidental response, could trigger a DoS in the client. The vulnerable path was error message construction in aiohttp/_http_parser.pyx, where an llhttp error-position pointer was used to build a snippet for malformed chunked responses and malformed request or response bytes at the buffer end. This issue is fixed in version 3.14.3.•CVE-2026-69244
  2. Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum request size on the compressed payload rather than the decompressed output, allowing a malicious client to send crafted requests that could consume excessive amounts of memory. Upgrading to Apache NiFi 2.11.0 is the recommended mitigation, which relocates response compression to Jetty Server and disables decompression of gzip-encoded HTTP requests.•CVE-2026-68981
  3. Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.•CVE-2026-58154
  4. Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue.•CVE-2026-58155
  5. Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability•CVE-2026-16812

References

Sources include official advisories and independent security research.