CVE-2025-32094

{"id": "CVE-2025-32094", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2025-08-07T05:15:45.667", "references": [{"url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100", "source": "cve@mitre.org"}, {"url": "https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling", "source": "cve@mitre.org"}, {"url": "https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103", "source": "cve@mitre.org"}, {"url": "https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-444"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an \"Expect: 100-continue\" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Akamai Ghost, utilizado en la plataforma CDN de Akamai antes del 26/03/2025. En determinadas circunstancias, un cliente que realiza una solicitud HTTP/1.x OPTIONS con un encabezado \"Expect: 100-continue\" y utiliza un plegado de l\u00ednea obsoleto, puede generar una discrepancia en la interpretaci\u00f3n de la solicitud por parte de dos servidores Akamai en la ruta, lo que permite a un atacante introducir una segunda solicitud en el cuerpo original."}], "lastModified": "2025-08-07T21:26:37.453", "sourceIdentifier": "cve@mitre.org"}