CVE-2026-88829: Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
Other sources
A vulnerability was found in the BusyBox httpd reverse proxy feature (networking/httpd.c). The P: reverse-proxy dispatch logic executes before Basic Authentication checks are performed. Because the relay function terminates via cgiioloopandexit(), which is marked NORETURN, any authentication rule (A:) configured on a proxied URL prefix is effectively dead code. Requests matching a proxy rule are forwarded to the backend server without any credential validation.
Additionally, the byte-transparent nature of the relay allows HTTP request pipelining. An attacker can craft pipelined HTTP requests that reach arbitrary backend paths and methods through the proxy, including administrative endpoints. Any HTTP method, including DELETE, PUT, and POST, is forwarded without credential checks.
This flaw enables unauthenticated remote attackers to access all backend resources behind the proxy, bypass intended access controls, and invoke arbitrary HTTP methods against backend services.
— Red Hat
Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
— Microsoft
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
BusyBox httpd deployments using reverse-proxy rules that forward requests matching a URL prefix to a backend server are exposed. The issue is especially significant where the proxy is intended to limit backend access to specific paths or protect proxied prefixes with Basic Authentication.
Does an attacker need credentials or a valid account?
No. Requests matching a proxy rule are forwarded before Basic Authentication checks, so configured authentication rules on a proxied URL prefix are not enforced. The reported vector is network-accessible and requires no privileges or user interaction.
What can an attacker reach through the proxy?
An attacker can send a pipelined second HTTP request that is relayed to the backend without path rewriting. This can expose arbitrary backend paths and HTTP methods, including administrative endpoints, rather than only the paths intended to be published by the proxy.
How can I identify a potentially affected configuration?
Review BusyBox httpd configuration for reverse-proxy dispatch rules that forward a URL prefix to a backend, particularly where Basic Authentication rules are also configured for that prefix. Such authentication rules are effectively bypassed for requests handled by the proxy relay.