REDHAT-BUG-2571610: Medium severity vulnerability

Published Nov 11, 2026

Updated

A flaw was found in BusyBox's httpd. When FEATUREHTTPDGZIP is enabled and a request for /FILE includes an Accept-Encoding: gzip header, httpd serves the pre-compressed FILE.gz if it exists, but authentication rules are matched against the request path only. As a result, a password rule configured for /secret.txt.gz can be bypassed by requesting /secret.txt with Accept-Encoding: gzip, disclosing the contents of the protected file. Only rules naming a specific .gz file are affected; directory rules cover both names.

Affected Software

0 affected components

Event History

Nov 11, 2026

Data Sourced

via Red Hat·09:29 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

BusyBox httpd deployments are exposed only when FEATURE_HTTPD_GZIP is enabled, a pre-compressed .gz version of a file exists, and authentication is configured specifically for that .gz filename. Directory-level authentication rules cover both the original and compressed names.

What does an attacker need to exploit it?

An attacker needs to request the uncompressed path, such as /secret.txt, while sending an Accept-Encoding: gzip header. If /secret.txt.gz exists and only that .gz path has a password rule, httpd can return the compressed protected content without applying that rule.

What can be done if patching is not immediately possible?

Avoid authentication rules that name individual .gz files. Use directory-level authentication rules for protected content, or disable FEATURE_HTTPD_GZIP where feasible.

How can I determine whether my configuration is affected?

Check whether FEATURE_HTTPD_GZIP is enabled and identify password rules targeting specific .gz files. For each such rule, verify whether the corresponding uncompressed file path can be requested with Accept-Encoding: gzip and whether the .gz file is served.

REDHAT-BUG-2571610: Medium severity vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can be done if patching is not immediately possible?

How can I determine whether my configuration is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can be done if patching is not immediately possible?

How can I determine whether my configuration is affected?