Akamai Ghost on CDN edge servers mishandles custom hop‑by‑hop HTTP headers. When an incoming request contains the header "Connection: Transfer-Encoding", the server may forward a request with invalid message framing, which can allow an attacker to smuggle requests into the origin server. The flaw is a weakness in HTTP message handling, listed as CWE‑444, and can lead to misinterpretation of request bodies, potentially enabling data tampering or injection of hidden requests.

The vulnerability affects Akamai Ghost CDN edge servers deployed before the February 6, 2026 release. No specific version numbers are provided, but any instances running the pre‑February 2026 firmware are susceptible. The issue is tied to the handling of hop‑by‑hop headers at the edge tier, which then passes malformed framing to back‑end origins.

The CVSS base score of 4.0 indicates moderate impact. EPSS is below 1%, suggesting a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a remote attacker crafting HTTP traffic to a publicly reachable edge server with the malformed header. Successful exploitation would result in the origin server parsing the request body incorrectly, enabling a request smuggling attack. No confirmed exploits are reported, but the presence of the flaw warrants monitoring and timely remediation.