# CVE-2026-124738: Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip

Status: published. Published: 2026-11-11. Updated: 2026-11-12.

A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.

## Remediation

- workaround: To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures:

1. Configure directory-level authentication:
In the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants.

2. Protect base filenames:
When individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`).

3. Restrict service access:
Restrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required.

Warning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 6 (busybox): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (busybox): Version range not reported. Source: CNA: redhat

## Severity and prioritization

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; source: CNA: redhat

- CVSS 3.1: 5.3 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.50% as of 2026-11-12; percentile 43.14%

- SSVC: exploitation none; automatable yes; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-288

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/security/cve/CVE-2026-124738 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2571610 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-124738 (secalert@redhat.com)

- https://bugzilla.redhat.com/show_bug.cgi?id=2571610 (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-124738; retrieved 2026-11-12; source updated 2026-11-12

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-124738; retrieved 2026-11-11; source updated 2026-11-11

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-124738; retrieved 2026-11-12; source updated Not reported

Revision: 11c6e2f767607c63b74d470115154aae75e40dbcaef59cb8906326814e161107

Canonical: https://y2.dev/cve/CVE-2026-124738

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.