CVE-2025-4600

8.7 highEPSS 0.2%

High (8.7) in google application load balancer. EPSS 0.2% chance of exploitation in the next 30 days.

A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-444
Published: 2025-05-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

google:application_load_balancer

References

https://cloud.google.com/support/bulletins#gcp-2025-027

Check your stack JSON