A flaw was found in BusyBox httpd’s reverse proxy feature: only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a second pipelined request that is forwarded unchanged, allowing the backend server to receive requests for arbitrary paths that were not intended to be exposed. This bypasses the intended path restrictions and can be used to reach sensitive resources behind the reverse proxy. The weakness is categorized as CWE‑444, a web cache side‑channel error that permits unexpected behavior in request handling.

The vulnerability affects BusyBox httpd shipped in Red Head Hardened Images (Hummingbird 1). No specific BusyBox version numbers are provided, so any deployment that includes the built‑in httpd reverse proxy and employs P: rules for path‑based access control is potentially impacted.

The CVSS score of 7.2 indicates high severity, but the EPSS score of less than 1 % shows low current exploitation probability. It is not listed in CISA’s KEV catalog. Exploitation requires a network connection to a host running the vulnerable httpd, the ability to send a pipelined request, and a configured reverse‑proxy rule. Successful exploitation allows an attacker to access arbitrary backend paths, compromising confidentiality and potentially bypassing access controls.