CVE-2025-32094: falha de média gravidade em AkamaiGhost
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4epss 0.6%
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Produtos afetados
Akamai · AkamaiGhostCVEs relacionadas — AkamaiGhost
No mesmo produto, das mais perigosas para as menos.
Referências
https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100https://www.akamai.com/blog/security/cve-2025-32094-http-request-smugglinghttps://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding