CVE-2026-124738 · Runtime
NO FIX YET
BusyBox's HTTP daemon checks authentication against the requested URL path, not the pre-compressed file it serves when pre-compressed file support is enabled. A remote attacker can request the uncompressed path with gzip encoding and read files that password rules were meant to protect.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only systems running BusyBox's httpd with pre-compressed file support enabled and password protection on specific files are exposed. Deployments that do not run httpd, or that have no password-protected files with compressed variants, can skip it. Embedded routers and appliances that bundle BusyBox are the likely places to look.
Not affected if httpd-not-used, no-password-rules, no-precompressed-support
Who cares busybox, embedded, httpd, routers
.gz handling option in the build or config), using busybox --help or the build configuration..gz counterparts exist on disk.busybox --help and compare it against the fixed version, which the sources do not state.No fix yet, per the sources.
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.