{"cve":"CVE-2024-8912","nvd":{"published":"2024-10-11T19:15:11.110","modified":"2026-06-17T08:23:32.913","status":"Analyzed","description":"An HTTP Request Smuggling vulnerability in Looker allowed an unauthorized attacker to capture HTTP responses destined for legitimate users.\n\nThere are two Looker versions that are hosted by Looker:\n\n  *  Looker (Google Cloud core) was found to be vulnerable. This issue has already been mitigated and our investigation has found no signs of exploitation.\n  *  Looker (original) was not vulnerable to this issue.\n\n\nCustomer-hosted Looker instances were found to be vulnerable and must be upgraded.\n\nThis vulnerability has been patched in all supported versions of customer-hosted Looker, which are available on the  Looker download page https://download.looker.com/ .\n\nFor Looker customer-hosted instances, please update to the latest supported version of Looker as soon as possible. The versions below have all been updated to protect from this vulnerability. You can download these versions at the Looker download page:\n\n  *  23.12 -> 23.12.123+\n  *  23.18 -> 23.18.117+\n  *  24.0 -> 24.0.92+\n  *  24.6 -> 24.6.77+\n  *  24.8 -> 24.8.66+\n  *  24.10 -> 24.10.78+\n  *  24.12 -> 24.12.56+\n  *  24.14 -> 24.14.37+","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":8.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-444"],"references":["https://cloud.google.com/looker/docs/best-practices/security-bulletin-09-16-24"],"products":["google:cloud_looker"],"source":"nvd","synced_at":"2026-10-19T21:55:31.737901711+00:00"},"epss":{"cve":"CVE-2024-8912","score":0.00193,"percentile":0.08993,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}