CVE-2026-88829
Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
- State
- Published
- Severity
- 7.2 High
- Published
- Oct 14, 2026
- Updated
- Oct 15, 2026
- Reserved
- Sep 10, 2026
Description
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N | redhat |
Weaknesses
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected Products
| Product | Versions |
|---|---|
Red Hat Hardened ImagesRed Hat |
References
- https://access.redhat.com/security/cve/CVE-2026-88829vdb-entry
- RHBZ#2531343issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.