A vulnerability was found in the BusyBox httpd IP-based access control list (ACL) parser (networking/httpd.c). When a D: (deny) rule is configured with a syntactically invalid CIDR prefix length, such as /999, the parser does not validate the mask value. Instead of rejecting the malformed rule or defaulting to a restrictive interpretation, the resulting miscalculated network mask silently fails to match the intended IP address range.

This means that a deny rule intended to block an entire subnet may effectively deny no traffic at all. The silent failure mode violates the principle of failing securely and could remain undetected for extended periods.