Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip
Summary
| CVE | CVE-2026-124738 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-11 12:19:47 UTC |
| Updated | 2026-11-11 12:19:47 UTC |
| Description | A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files. |
Risk And Classification
Primary CVSS: v3.1 5.3 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Problem Types: CWE-288 | CWE-288 Authentication Bypass Using an Alternate Path or Channel
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 3.1 | CNA | CVSS | 5.3 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Hardened Images | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/security/cve/CVE-2026-124738 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank ducanhluu for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-10-25T13:35:53.000Z | Reported to Red Hat. |
| CNA | 2026-11-11T09:15:15.000Z | Made public. |
Workarounds
CNA: To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures: 1. Configure directory-level authentication: In the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants. 2. Protect base filenames: When individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`). 3. Restrict service access: Restrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required. Warning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions.