CVE-2026-124738
Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.
Fixes and workarounds
Workaround
To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures: 1. Configure directory-level authentication: In the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants. 2. Protect base filenames: When individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`). 3. Restrict service access: Restrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required. Warning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions.
Source: CNA: redhatAffected products and versions
| Product | Versions | Authority |
|---|---|---|
| Red Hat Enterprise Linux 6 Red Hat busybox
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: unaffected |
CNA: redhat |
| Red Hat Hardened Images Red Hat busybox
https://access.redhat.com/downloads/content/package-browser/ |
Range not reported
Other versions: affected |
CNA: redhat |
Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.
CVSS assessments
| Version / score | Vector | Authority |
|---|---|---|
| 3.1 / 5.3 medium |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CNA: redhat |
| 3.1 / 5.3 medium |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD: [email protected] |
Exploit evidence
No exploit evidence in collected sources. This is not proof of no exploitation.
References
- https://access.redhat.com/security/cve/CVE-2026-124738CNA: redhat · vdb-entry, x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2571610CNA: redhat · issue-tracking, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-124738[email protected]
- https://bugzilla.redhat.com/show_bug.cgi?id=2571610[email protected]
For agents and automation
Read public disclosures for free as Markdown or JSON. Compatible browsers also expose native WebMCP tools to search disclosures, read this page, and discover API access.
Use the ontology-linked Cyber API with x402 pay per request, or a Y2 Pro or Elite API key with the intel:cyber scope.
Endpoints and access details
https://api.y2.dev/api/v2/cyber/cveshttps://api.y2.dev/api/v2/cyber/cves/{cveId}
A workspace owner or admin can create a Pro or Elite API key. Send Authorization: Bearer <Y2_API_KEY> from your trusted agent runtime.
For x402, omit Authorization and read the HTTP 402 payment challenge before signing a retry. Public browser tools do not make payments.