Top 10 winner

Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes

Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes ($50K+ Bounty Earned)

Jacopo Tediosi · Medium · 17 February 2023

Listing Content-Length in the Connection header marks it hop-by-hop, so Akamai's first proxy stripped it and the request body became a second request. The surplus response desynchronised the connection and was served to other users, and edge nodes cached it, letting an attacker publish arbitrary content under almost any Akamai-fronted domain across a whole region.

Record

Document

Worldwide Server-side Cache Poisoning on All Akamai Edge Nodes ($50K+ Bounty Earned)

Researcher

Jacopo Tediosi

Published by

Medium

Date

17 February 2023

Topic

HTTP

In the archive

• Ranked #7 in the 2022 Top 10 Web Hacking Techniques

Related sources

• Earlier response-smuggling presentation
• Security Now 891: Poisoning Akamai

Tags

• request-smuggling
• cache-poisoning
• desync
• http
• cdn
• proxy
• header-injection
• bug-bounty
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Jacopo Tediosi, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 10 August 2026.