« Volver al listado

CVE-2025-32094

Estado: AplazadaMedia (4)—

An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Akamai — CDNAIAkamai — GhostAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32094",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32094",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-08-07T14:39:53.646755Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Akamai",
          "product": "AkamaiGhost",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2025-03-26",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-08-07T05:15:45.667",
  "references": [
    {
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Status/100",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.akamai.com/blog/security/cve-2025-32094-http-request-smuggling",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.blackhat.com/us-25/briefings/schedule/#http1-must-die-the-desync-endgame-45103",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.rfc-editor.org/rfc/rfc9112.html#name-obsolete-line-folding",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an \"Expect: 100-continue\" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Akamai Ghost, utilizado en la plataforma CDN de Akamai antes del 26/03/2025. En determinadas circunstancias, un cliente que realiza una solicitud HTTP/1.x OPTIONS con un encabezado \"Expect: 100-continue\" y utiliza un plegado de línea obsoleto, puede generar una discrepancia en la interpretación de la solicitud por parte de dos servidores Akamai en la ruta, lo que permite a un atacante introducir una segunda solicitud en el cuerpo original."
    }
  ],
  "lastModified": "2026-06-17T09:11:26.120",
  "sourceIdentifier": "cve@mitre.org"
}