Listen to this Post
How CVE-2025-4600 Works
CVE-2025-4600 exploits HTTP request smuggling in Google Cloud’s Classic Application Load Balancer by manipulating chunked transfer encoding. Attackers craft malicious HTTP requests with inconsistent chunk sizes or stray data after the final chunk. The load balancer improperly forwards these malformed requests to backend servers, which may interpret them differently. This discrepancy allows request smuggling, enabling cache poisoning, session hijacking, or unauthorized access to internal services. The vulnerability stems from insufficient validation of chunked encoding boundaries.
DailyCVE Form
Platform: Google Cloud
Version: Classic ALB
Vulnerability: Request Smuggling
Severity: Critical
Date: 2025-04-26
Prediction: Patch deployed
What Undercode Say
curl -H "Transfer-Encoding: chunked" -d "0\r\n\r\nX" http://vulnerable-target.com
import requests
requests.post("http://target", headers={"Transfer-Encoding": "chunked"}, data="0\r\n\r\nSMUGGLED")
How Exploit
- Craft chunked-encoded HTTP requests with trailing data.
- Bypass security controls via backend parsing discrepancies.
- Poison caches or hijack sessions.
Protection from this CVE
- Upgrade load balancer.
- Disable legacy ALB.
- Monitor anomalous requests.
Impact
- Unauthorized data access.
- Cache poisoning.
- Session hijacking.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
