CVE-2025-32094: Akamai Akamaighost

Medium severity, CVSS 4.0. EPSS: 0.6% chance of exploitation in the next 30 days.

An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTIONS request with an "Expect: 100-continue" header, and using obsolete line folding, can lead to a discrepancy in how two in-path Akamai servers interpret the request, allowing an attacker to smuggle a second request in the original request body.

Affected products

• Akamai Akamaighost: before 2025-03-26 (fixed in 2025-03-26)

Published 2025-08-07. Last modified 2026-06-17.