A flaw was found in BusyBox httpd’s reverse proxy functionality. When configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that the server forwards unchanged to the backend, bypassing the intended path restrictions. This flaw enables unauthorized access to backend paths that were not meant to be exposed. The vulnerability is classified as CWE‑444, which denotes HTTP request smuggling.

The issue affects BusyBox httpd included in Red Hat Hardened Images, specifically Hummingbird 1. Any deployment that uses the built‑in httpd reverse‑proxy feature and relies on P: rules for path‑based access control is potentially impacted.

The CVSS score of 7.2 indicates high severity, while an EPSS score of less than 1 % shows a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a network connection to a host running the vulnerable httpd, the ability to send a pipelined request, and a configured reverse‑proxy rule. Successful exploitation permits an attacker to access arbitrary backend paths, compromising confidentiality and potentially bypassing access controls.