{"id":"CVE-2026-124738","kind":"vulnerability","aliases":["CVE-2026-124738"],"related":[],"title":"BusyBox httpd: pre-compressed file requests can bypass path-based password rules","description":"A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.","summary":"BusyBox's HTTP daemon checks authentication against the requested URL path, not the pre-compressed file it serves when pre-compressed file support is enabled. A remote attacker can request the uncompressed path with gzip encoding and read files that password rules were meant to protect.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["busybox","embedded","httpd","routers","runtime"],"not_affected_if":["httpd-not-used","no-password-rules","no-precompressed-support"],"how_to_check":"- Check whether httpd is run with pre-compressed file support enabled (the `.gz` handling option in the build or config), using `busybox --help` or the build configuration.\n- Check whether httpd password rules (the httpd config file) protect paths whose compressed `.gz` counterparts exist on disk.\n- Check the installed version with `busybox --help` and compare it against the fixed version, which the sources do not state.","fix":null,"status":"open","published_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:28:51+00:00","updated_at":"2026-11-11T12:28:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T12:28:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BusyBox httpd: pre-compressed file requests can bypass path-based password rules","impact":"medium","summary":"BusyBox's HTTP daemon checks authentication against the requested URL path, not the pre-compressed file it serves when pre-compressed file support is enabled. A remote attacker can request the uncompressed path with gzip encoding and read files that password rules were meant to protect.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["busybox","httpd","embedded","routers"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Password-protected files are readable by unauthenticated remote attackers","analyst_note":"Find the fixed BusyBox version and the upstream fix commit; the NVD entry in the sources does not give them.","how_to_check":"- Check whether httpd is run with pre-compressed file support enabled (the `.gz` handling option in the build or config), using `busybox --help` or the build configuration.\n- Check whether httpd password rules (the httpd config file) protect paths whose compressed `.gz` counterparts exist on disk.\n- Check the installed version with `busybox --help` and compare it against the fixed version, which the sources do not state.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["httpd-not-used","no-precompressed-support","no-password-rules"],"who_is_affected":"Only systems running BusyBox's httpd with pre-compressed file support enabled and password protection on specific files are exposed. Deployments that do not run httpd, or that have no password-protected files with compressed variants, can skip it. Embedded routers and appliances that bundle BusyBox are the likely places to look.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000783,"input_tokens":4583,"output_tokens":649,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124738':17A,20A '-2026':16A,19A 'attack':55B,113C 'authent':31B,92C 'base':12A 'busybox':1A,21B,26B,79C 'bypass':9A,128C 'check':30B,93C 'compress':5A,41B,48B,88C,107C,135C 'configur':131C 'cve':15A,18A 'daemon':29B,83C 'disclosur':144C 'embed':22B 'enabl':52B,91C 'encod':63B,127C 'evalu':95C 'exploit':115C 'file':6A,42B,49B,66B,89C,108C,122C,136C,147C 'flaw':75C,117C 'found':77C 'gzip':62B,126C 'http':28B,82C 'httpd':2A,23B,84C 'inform':143C 'lead':140C 'meant':71B 'password':13A,68B,129C 'path':11A,36B,60B,101C,123C 'path-bas':10A 'pre':4A,40B,47B,87C,106C 'pre-compress':3A,39B,46B,86C,105C 'protect':73B 'rather':102C 'read':65B 'remot':54B,112C 'request':7A,34B,57B,99C,119C 'router':24B 'rule':14A,69B,130C 'runtim':25B 'sensit':146C 'serv':44B,110C 'specif':132C 'specifi':125C 'support':50B,90C 'unauthor':142C 'uncompress':59B,121C 'url':35B,100C 'vulner':138C","nicknames":[],"mitigations":[],"who_affected":"Only systems running BusyBox's httpd with pre-compressed file support enabled and password protection on specific files are exposed. Deployments that do not run httpd, or that have no password-protected files with compressed variants, can skip it. Embedded routers and appliances that bundle BusyBox are the likely places to look.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["busybox","embedded","httpd","medium","routers","runtime"],"campaign_type":null,"search_a":"'-124738':17A,20A '-2026':16A,19A 'base':12A 'busybox':1A 'bypass':9A 'compress':5A 'cve':15A,18A 'file':6A 'httpd':2A 'password':13A 'path':11A 'path-bas':10A 'pre':4A 'pre-compress':3A 'request':7A 'rule':14A","search_b":"'attack':55B 'authent':31B 'busybox':21B,26B 'check':30B 'compress':41B,48B 'daemon':29B 'embed':22B 'enabl':52B 'encod':63B 'file':42B,49B,66B 'gzip':62B 'http':28B 'httpd':23B 'meant':71B 'password':68B 'path':36B,60B 'pre':40B,47B 'pre-compress':39B,46B 'protect':73B 'read':65B 'remot':54B 'request':34B,57B 'router':24B 'rule':69B 'runtim':25B 'serv':44B 'support':50B 'uncompress':59B 'url':35B","search_c":"'attack':113C 'authent':92C 'busybox':79C 'bypass':128C 'check':93C 'compress':88C,107C,135C 'configur':131C 'daemon':83C 'disclosur':144C 'enabl':91C 'encod':127C 'evalu':95C 'exploit':115C 'file':89C,108C,122C,136C,147C 'flaw':75C,117C 'found':77C 'gzip':126C 'http':82C 'httpd':84C 'inform':143C 'lead':140C 'password':129C 'path':101C,123C 'pre':87C,106C 'pre-compress':86C,105C 'rather':102C 'remot':112C 'request':99C,119C 'rule':130C 'sensit':146C 'serv':110C 'specif':132C 'specifi':125C 'support':90C 'unauthor':142C 'uncompress':121C 'url':100C 'vulner':138C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124738","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124738","severity":null,"published_at":"2026-11-11T12:19:47+00:00","modified_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}