CVE-2026-88829
7.2HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-444
Impact
Remote, unauthenticated attackers can access restricted or internal paths on backend servers behind BusyBox httpd. They only need network access to send pipelined HTTP requests over a single TCP connection.
Root cause
BusyBox httpd's reverse proxy only applies path rewriting to the initial HTTP request on a connection, forwarding subsequent pipelined requests verbatim to the backend.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Fix & remediation
Upgrade BusyBox once patched upstream or by your distribution; as an interim workaround, disable the reverse proxy feature in httpd.conf or place an intermediary proxy that drops HTTP pipelined requests in front of httpd.
$ busybox httpd -vAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.