PT-2025-32252 · Akamai · Akamaighost

Published 2025-08-07 · Updated 2025-08-07 · CVE-2025-32094

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Akamai Ghost versions prior to 2025-03-26

Description An issue exists in Akamai Ghost, used for the Akamai CDN platform. A client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can cause a discrepancy in how two in-path Akamai servers interpret the request. This allows an attacker to smuggle a second request in the original request body.

Recommendations Update Akamai Ghost to version 2025-03-26 or later.

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2025-32094

Affected Products

Akamaighost

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-32094 · Security Note
• https://t.me/CVEtracker/29423 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1953344715408969899 · Twitter Post
• https://twitter.com/UndercodeNews/status/1953459818066247798 · Twitter Post
• https://twitter.com/CVEnew/status/1953320074460500193 · Twitter Post
• https://t.me/cveNotify/131200 · Telegram Post
• https://twitter.com/takuzoo3868/status/1953276470597697883 · Twitter Post
• https://rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding · Note
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100 · Note
• https://blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103 · Note
• https://akamai.com/blog/security/cve-2025-32094-http-request-smuggling · Note