Description
An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Akamai AkamaiGhost
Default version status: unaffected
0 to < 2025-03-26affected
References
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100 ↗
- https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding ↗
- https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling ↗
- https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103 ↗