Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2025-32094: Akamai CDN Platform: Malicious Request Injection via HTTP Request Smuggling
CVE-2025-32094 · published 1 year ago
Summary
A security issue affects the Akamai CDN platform before a certain date. An attacker can send a specific type of HTTP request that could trick the system into processing two requests instead of one, potentially allowing them to access unauthorized data. To protect your system, apply the available update or patch released after 2025-03-26.
Original advisory text
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continu...
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
References
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100
- https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling
- https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-end...
- https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Timeline
Published7 Aug 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
CVE-2025-32094 · NVD
Track software like this
Free during beta