HTTP Request Smuggling Vulnerability in Akamai CDN Platform

CVE-2025-32094

What is CVE-2025-32094?

An issue has been identified in Akamai Ghost for the Akamai CDN platform prior to March 26, 2025. This vulnerability arises from the handling of HTTP/1.x OPTIONS requests, specifically when these requests include an 'Expect: 100-continue' header and use obsolete line folding techniques. Under certain conditions, this can create a discrepancy in how two Akamai servers interpret the request, leading to the potential for an attacker to smuggle a second request within the original request body. This flaw may compromise security by allowing unauthorized commands to bypass standard protective measures.

References