{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124738", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-11-09T11:36:29.478Z", "datePublished": "2026-11-11T11:19:49.225Z", "dateUpdated": "2026-11-11T11:19:49.225Z"}, "containers": {"cna": {"title": "Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "busybox", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "busybox", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-124738", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571610", "name": "RHBZ#2571610", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-11T09:15:15.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "description": "Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures:\n\n1. Configure directory-level authentication:\nIn the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants.\n\n2. Protect base filenames:\nWhen individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`).\n\n3. Restrict service access:\nRestrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required.\n\nWarning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions."}], "timeline": [{"lang": "en", "time": "2026-10-25T13:35:53.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-11T09:15:15.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank ducanhluu for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-11T11:19:49.225Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{"affected": [{"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:rhel_els:6"], "defaultStatus": "unaffected", "packageName": "busybox", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "busybox", "product": "Red Hat Hardened Images", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files."}], "id": "CVE-2026-124738", "lastModified": "2026-11-11T12:19:47.673", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Primary"}]}, "published": "2026-11-11T12:19:47.537", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/security/cve/CVE-2026-124738"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571610"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "secalert@redhat.com", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank ducanhluu for reporting this issue.", "bugzilla": {"description": "busybox: httpd password rule bypass for pre-compressed .gz files via Accept-Encoding: gzip", "id": "2571610", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571610"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-288", "details": ["A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files."], "mitigation": {"lang": "en:us", "value": "To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures:\n1. Configure directory-level authentication:\nIn the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants.\n2. Protect base filenames:\nWhen individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`).\n3. Restrict service access:\nRestrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required.\nWarning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions."}, "name": "CVE-2026-124738", "package_state": [{"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Not affected", "package_name": "busybox", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Affected", "package_name": "busybox", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-11T09:15:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-124738\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-124738"], "statement": "This vulnerability is assessed as Moderate rather than Important because exploitation is constrained to niche configurations where authentication directives explicitly target individual compressed archive filenames instead of directory paths. In Red Hat enterprise distributions, BusyBox is generally restricted to lightweight recovery shells and initramfs environments rather than standalone production web services. Consequently, exposure of the embedded httpd service with pre-compressed file serving is uncommon under default installations.", "threat_severity": "Moderate"}

{}