Vulnerability · Published Oct 14, 2026 · Assigned by redhat

CVE-2026-88829Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

High 7.2

In plain English

A high-severity security flaw in Red Hat Hardened Images from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High

Exploit odds (30 days)0.3%top 82.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	busybox	no fix listed	DEBIAN-CVE-2026-88829
Debian:13	busybox	no fix listed	DEBIAN-CVE-2026-88829
Debian:14	busybox	no fix listed	DEBIAN-CVE-2026-88829
Ubuntu:22.04:LTS	busybox	no fix listed	UBUNTU-CVE-2026-88829
Ubuntu:24.04:LTS	busybox	no fix listed	UBUNTU-CVE-2026-88829
Ubuntu:26.04:LTS	busybox	no fix listed	UBUNTU-CVE-2026-88829
Ubuntu:26.10	busybox	no fix listed	UBUNTU-CVE-2026-88829

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat Hardened Images	see references

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

References

https://access.redhat.com/security/cve/CVE-2026-88829 vdb-entry, x_refsource_REDHAT
RHBZ#2531343 issue-tracking, x_refsource_REDHAT