Google Cloud Classic Application Load Balancer request smuggling

Summaryinfo

A vulnerability was found in Google Cloud Classic Application Load Balancer and classified as problematic. Impacted is an unknown function. Executing a manipulation can lead to request smuggling. This vulnerability is tracked as CVE-2025-4600. The attack can be launched remotely. No exploit exists. This product is a managed service, which means users themselves cannot handle vulnerability countermeasures.

Detailsinfo

A vulnerability was found in Google Cloud Classic Application Load Balancer (the affected version is unknown). It has been declared as problematic. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a request smuggling vulnerability. The CWE definition for the vulnerability is CWE-444. The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination. As an impact it is known to affect integrity. CVE summarizes:

A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.

The advisory is shared for download at cloud.google.com. This vulnerability was named CVE-2025-4600 since 05/12/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/29/2025).

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-15449). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Google

Name

• Cloud Classic Application Load Balancer

License

• free

Managed Service

• yes

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion