Google Cloud Classic Application Load Balancer Request Smuggling Vulnerability

A request smuggling vulnerability has been identified in the Google Cloud Classic Application Load Balancer. This vulnerability arises from improper handling of chunked-encoded HTTP requests, allowing attackers to craft requests that could be misinterpreted by backend servers. The issue has been resolved by disallowing stray data after a chunk, and the vulnerability is no longer exploitable. Classic Application Load Balancer service is not vulnerable after April 26, 2025.

Impact

Exploitation of this vulnerability allowed for request smuggling, where crafted HTTP requests could be misinterpreted by backend servers, potentially leading to unauthorized actions or access.