CVE-2025-32094: Medium severity Akamai Ghost vulnerability
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32094?
CVE-2025-32094 has a medium severity rating due to the potential for HTTP request smuggling attacks.
How do I fix CVE-2025-32094?
To mitigate CVE-2025-32094, ensure that Akamai Ghost is updated to the version released after 2025-03-26.
What causes the vulnerability in CVE-2025-32094?
CVE-2025-32094 is caused by the handling of HTTP/1.x OPTIONS requests with the "Expect: 100-continue" header using obsolete line folding.
Which versions of Akamai Ghost are affected by CVE-2025-32094?
Akamai Ghost versions prior to 2025-03-26 are affected by CVE-2025-32094.
Can CVE-2025-32094 be exploited remotely?
Yes, CVE-2025-32094 can be exploited remotely if the conditions for the HTTP request smuggling are met.