CVE-2025-4600: Google Application Load Balancer

High severity, CVSS 7.5. EPSS: 0.2% chance of exploitation in the next 30 days.

A request smuggling vulnerability existed in the Google Cloud Classic Application Load Balancer due to improper handling of chunked-encoded HTTP requests. This allowed attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk, and is no longer exploitable. No action is required as Classic Application Load Balancer service after 2025-04-26 is not vulnerable.

Affected products

• Google Application Load Balancer: before 2025-04-26 (fixed in 2025-04-26)

Published 2025-05-16. Last modified 2026-06-17.