CVE-2025-4600 details a request smuggling vulnerability in the Google Cloud Classic Application Load Balancer, stemming from improper handling of chunked HTTP requests. This flaw could allow attackers to manipulate requests, potentially leading to data integrity issues on backend servers. Rated 7.5 HIGH on the CVSS scale, it presents a network-based attack with low complexity and high impact on integrity, though confidentiality and availability are not affected. Google has patched this issue, and no action is required for Classic Application Load Balancer services after April 26, 2025, as they are no longer vulnerable. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2025-04-26CPE matchmatch criteria | cpe:2.3:a:google:application_load_balancer:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Request Smuggling in Classic Application Load Balancer
Apr 26, 2025Request smuggling vulnerability in Classic Application Load Balancer (CVE-2025-4600)
Apr 26, 2025Request smuggling vulnerability in Classic Application Load Balancer
Apr 26, 2025