linode.com
By Akamai Vulnerability disclosure program on security.txt akamai.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 1
- Public CVEs
- 7
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
Scope
1 asset you may test.
Domains 1
- linode.com
Changes
Tracked since 11 Nov 2026. Last checked 2 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2025-66373 | Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Ghost receives an invalid chunked body that includes a chunk size different from the actual size of the following chunk data, under certain circumstances, Akamai Ghost erroneously forwards the invalid request and subsequent superfluous bytes t | Medium 4.8 | 4 Dec 2025 |
| CVE-2024-45164 | Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy | High 7.1 | 4 Nov 2024 |
| CVE-2021-40683 | In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack the flow of execution. | High 7.8 | 4 Oct 2021 |
| CVE-2019-18847 | Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1. | Critical 9.8 | 26 Aug 2020 |
| CVE-2019-11011 | Akamai CloudTest before 58.30 allows remote code execution. | Critical 9.8 | 21 Jun 2019 |
| CVE-2016-10157 | Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code within the Akamai NetSession process space. | Critical 9.8 | 23 Jan 2017 |
| CVE-2008-1770 | CRLF injection vulnerability in Akamai Download Manager ActiveX control before 2.2.3.6 allows remote attackers to force the download and execution of arbitrary files via a URL parameter containing an encoded LF followed by a malicious target line. | High 9.3 | 4 Jun 2008 |