CVE Feed

    Dashboard / CVE / CVE-2026-88829

    CVE-2026-88829

    A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

    Published:Oct 14, 2026
    Last Modified:Oct 25, 2026
    EPS:Oct 14, 2026
    EPSS Score:0.00317
    CVSS Score:7.2

    Affected Products

    Vendor
    Busybox
    Product
    Busybox
    Vendor
    Redhat
    Product
    Hardened Images
    Vendor
    Redhat
    Product
    Hummingbird

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-273 HTTP Response Smuggling
    CAPEC-33 HTTP Request Smuggling

    Related CVEs

    CVE-2026-92205 (CVSS 6.1) — BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allow…
    CVE-2026-90954 (CVSS 7.8) — A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks af…
    CVE-2026-88838 (CVSS 5.5) — A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /et…
    CVE-2026-88834 (CVSS 3.7) — A flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user ex…
    CVE-2026-88833 (CVSS 6.5) — A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the va…
    CVE-2026-108119 (CVSS 6.3) — A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries…
    CVE-2026-88830 (CVSS 7.5) — A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer…
    CVE-2026-88837 (CVSS 6.5) — BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the au…
    CVE-2026-88835 (CVSS 6.1) — BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bo…
    CVE-2026-88839 (CVSS 6.7) — BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds w…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High