PT-2025-21652 · Google · Google Cloud Classic Application Load Balancer

Published 2025-05-16 · Updated 2025-07-29 · CVE-2025-4600

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:L

Name of the Vulnerable Software and Affected Versions: Google Cloud Classic Application Load Balancer versions prior to 2025-04-26

Description: A request smuggling issue existed due to improper handling of chunked-encoded HTTP requests, allowing attackers to craft requests that could be misinterpreted by backend servers. The issue was fixed by disallowing stray data after a chunk.

Recommendations: For Google Cloud Classic Application Load Balancer versions prior to 2025-04-26, no action is required as the issue is fixed in versions after 2025-04-26.

Fix

RCE

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-20

CWE-444

Related Identifiers

CVE-2025-4600

Affected Products

Google Cloud Classic Application Load Balancer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-4600 · Security Note
• https://osv.dev/vulnerability/CVE-2025-4600 · Vendor Advisory
• https://cloud.google.com/support/bulletins#gcp-2025-027 · Vendor Advisory
• https://twitter.com/CVEnew/status/1923434472638476288 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1923388898916344225 · Twitter Post
• https://t.me/cvetracker/24031 · Telegram Post
• https://twitter.com/CveFindCom/status/1923378488888684817 · Twitter Post
• https://t.me/cveNotify/130110 · Telegram Post
• https://twitter.com/dailycve/status/1950272447418163543 · Twitter Post