Bug 2531343 (CVE-2026-88829)

Summary: CVE-2026-88829 busybox: busybox: HTTP request smuggling via pipelined requests in httpd reverse proxy
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2552119    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-10 09:45:29 UTC 
A vulnerability was found in the BusyBox httpd reverse proxy feature (networking/httpd.c). The P: reverse-proxy dispatch logic executes before Basic Authentication checks are performed. Because the relay function terminates via cgi_io_loop_and_exit(), which is marked NORETURN, any authentication rule (A:) configured on a proxied URL prefix is effectively dead code. Requests matching a proxy rule are forwarded to the backend server without any credential validation.

Additionally, the byte-transparent nature of the relay allows HTTP request pipelining. An attacker can craft pipelined HTTP requests that reach arbitrary backend paths and methods through the proxy, including administrative endpoints. Any HTTP method, including DELETE, PUT, and POST, is forwarded without credential checks.

This flaw enables unauthenticated remote attackers to access all backend resources behind the proxy, bypass intended access controls, and invoke arbitrary HTTP methods against backend services.