---
id: "CVE-2026-124738"
page: "https://infrastack.ai/live/CVE-2026-124738"
kind: "vulnerability"
aliases: ["CVE-2026-124738"]
title: "BusyBox httpd: pre-compressed file requests can bypass path-based password rules"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["busybox", "embedded", "httpd", "routers", "runtime"]
not_affected_if: ["httpd-not-used", "no-password-rules", "no-precompressed-support"]
published_at: "2026-11-11T12:19:47+00:00"
first_seen_at: "2026-11-11T12:27:11+00:00"
updated_at: "2026-11-11T12:28:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124738", "first_seen_at": "2026-11-11T12:27:11+00:00"}]
exploit_sources: []
---

# BusyBox httpd: pre-compressed file requests can bypass path-based password rules

Link for people: https://infrastack.ai/live/CVE-2026-124738 (this .md is for agents)

BusyBox's HTTP daemon checks authentication against the requested URL path, not the pre-compressed file it serves when pre-compressed file support is enabled. A remote attacker can request the uncompressed path with gzip encoding and read files that password rules were meant to protect.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether httpd is run with pre-compressed file support enabled (the `.gz` handling option in the build or config), using `busybox --help` or the build configuration.
- Check whether httpd password rules (the httpd config file) protect paths whose compressed `.gz` counterparts exist on disk.
- Check the installed version with `busybox --help` and compare it against the fixed version, which the sources do not state.

## Timeline

- 2026-11-11T12:27:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124738

## From the sources

A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_