{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124738", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2026-11-09T11:36:29.478Z", "datePublished": "2026-11-11T11:19:49.225Z", "dateUpdated": "2026-11-11T11:19:49.225Z"}, "containers": {"cna": {"title": "Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files."}], "affected": [{"vendor": "Red Hat", "product": "Red Hat Enterprise Linux 6", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "busybox", "defaultStatus": "unaffected", "cpes": ["cpe:/o:redhat:rhel_els:6"]}, {"vendor": "Red Hat", "product": "Red Hat Hardened Images", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "busybox", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:hummingbird:1"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2026-124738", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2571610", "name": "RHBZ#2571610", "tags": ["issue-tracking", "x_refsource_REDHAT"]}], "datePublic": "2026-11-11T09:15:15.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "description": "Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "workarounds": [{"lang": "en", "value": "To mitigate this vulnerability without modifying binary features, apply one of the following configuration measures:\n\n1. Configure directory-level authentication:\nIn the BusyBox `httpd.conf` configuration file, define authentication rules covering the containing directory rather than individual file paths. Directory rules are evaluated against both the base request and served compressed variants.\n\n2. Protect base filenames:\nWhen individual file protection is necessary, configure password rules for both the uncompressed filename and the `.gz` filename (for example, applying the directive to both `/secret.txt` and `/secret.txt.gz`).\n\n3. Restrict service access:\nRestrict network reachability to the BusyBox httpd daemon using local firewall rules if remote access is not required.\n\nWarning: Applying changes to httpd.conf requires restarting or reloading the BusyBox httpd process, which will temporarily terminate active network sessions."}], "timeline": [{"lang": "en", "time": "2026-10-25T13:35:53.000Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-11-11T09:15:15.000Z", "value": "Made public."}], "credits": [{"lang": "en", "value": "Red Hat would like to thank ducanhluu for reporting this issue."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-11T11:19:49.225Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}}}

{}

{}

{}

{}