UBUNTU-CVE-2026-124738: Medium severity ubuntu/busybox vulnerability
A flaw was found in BusyBox. When the HTTP daemon (httpd) has pre-compressed file support enabled, authentication checks are evaluated only against the requested URL path rather than the pre-compressed file being served. A remote attacker can exploit this flaw by requesting an uncompressed file path while specifying gzip encoding, bypassing password rules configured specifically for the compressed file. This vulnerability can lead to unauthorized information disclosure of sensitive files.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running BusyBox httpd with pre-compressed file support enabled are exposed when password rules are configured specifically for compressed files. The issue is remotely exploitable against the HTTP service.
What does an attacker need to do to exploit it?
An attacker requests an uncompressed file path while indicating support for gzip encoding. BusyBox httpd can then serve the pre-compressed file while applying authentication checks only to the requested uncompressed path.
Are password-protected compressed files affected by default?
The available information only identifies exposure when pre-compressed file support is enabled and password rules are configured specifically for compressed files. It does not state whether these settings are enabled by default.
How can I determine whether my deployment may be affected?
Review the BusyBox httpd configuration for enabled pre-compressed file support and password rules that apply specifically to compressed files. Test whether requesting an uncompressed path with gzip encoding returns a protected compressed resource without the expected authentication.