CVE-2026-124738
Description
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.
Statement
This vulnerability is assessed as Moderate rather than Important because exploitation is constrained to niche configurations where authentication directives explicitly target individual compressed archive filenames instead of directory paths. In Red Hat enterprise distributions, BusyBox is generally restricted to lightweight recovery shells and initramfs environments rather than standalone production web services. Consequently, exposure of the embedded httpd service with pre-compressed file serving is uncommon under default installations.
Mitigation
To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures:
1. Configure directory-level authentication:
In the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants.
2. Protect base filenames:
When individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`).
3. Restrict service access:
Restrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required.
Warning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Acknowledgements
Red Hat would like to thank ducanhluu for reporting this issue.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
