CVE-2026-124738: Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip

Published Nov 11, 2026

Updated

A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.

Other sources

A flaw was found in BusyBox's httpd. When FEATUREHTTPDGZIP is enabled and a request for /FILE includes an Accept-Encoding: gzip header, httpd serves the pre-compressed FILE.gz if it exists, but authentication rules are matched against the request path only. As a result, a password rule configured for /secret.txt.gz can be bypassed by requesting /secret.txt with Accept-Encoding: gzip, disclosing the contents of the protected file. Only rules naming a specific .gz file are affected; directory rules cover both names.

— Red Hat

Affected Software

0 affected components

Event History

Nov 11, 2026

Data Sourced

via Red Hat·09:29 AM

DescriptionSeverityAffected Software

CVE Published

via MITRE·11:19 AM

Data Sourced

via MITRE·11:19 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

BusyBox httpd deployments are affected when FEATURE_HTTPD_GZIP is enabled, a pre-compressed .gz version of a file exists, and authentication is configured specifically for that .gz filename. Directory-based password rules cover both the compressed and uncompressed names and are not affected by this bypass.

What does an attacker need to exploit the issue?

An attacker only needs network access to the HTTP daemon. They can request the uncompressed path, such as /secret.txt, with an Accept-Encoding: gzip header; if /secret.txt.gz exists, httpd serves it while evaluating authentication against the uncompressed path.

What can be exposed?

The issue can disclose the contents of protected pre-compressed files whose access control is applied only to their specific .gz paths. The provided information identifies information disclosure and does not describe integrity or availability impact.

What can be done if patching is not immediately possible?

Avoid password rules that name individual .gz files. Use directory-level authentication rules instead, because those rules cover both the compressed filename and its corresponding uncompressed request path.

CVE-2026-124738: Busybox: httpd password rule bypass for pre-compressed .gz files via accept-encoding: gzip

Other sources

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit the issue?

What can be exposed?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit the issue?

What can be exposed?

What can be done if patching is not immediately possible?