CVE-2026-88829
Published: October 20, 2026Last modified: October 23, 2026
Description
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.2 |
| Attack Vector | NETWORK |
| Attack complexity | LOW |
| Privileges required | NONE |
| User interaction | NONE |
| Scope | CHANGED |
| Confidentiality | LOW |
| Integrity impact | LOW |
| Availability impact | NONE |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Notes
httpd is included only as part of busybox-extras.
Status
| Product | Release | Package | Status |
|---|---|---|---|
| Alpaquita Linux | 23 LTS | busybox | Vulnerable (1.35.0-r29) |
| 25 LTS | busybox | Vulnerable (1.37.0-r20) | |
| Stream | busybox | Vulnerable (1.36.1-r1) | |
| Hardened Containers | 23 LTS | busybox | Not affected (1.35.0-r29) |
| 25 LTS | busybox | Not affected (1.37.0-r20) | |
| Stream | busybox | Not affected (1.36.1-r1) |