Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
Not in CISA KEV
HIGH severity

CVE-2026-88829 — Red Hat

HIGH

CVE-2026-88829 is a high-severity (CVSS 7.2) CWE-444 vulnerability. No vendor fix is recorded yet; mitigation options are listed below.

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on…

Published
Updated
Affected
—
Patched
—
Exploits
None indexed
Exploitation data as of Oct 14, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Description

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.

Detection & mitigation playbook

Vulnerability

  1. Detect

    Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).

  2. Remediation status

    No fixed release is recorded for CVE-2026-88829 yet. Track the upstream advisory, and apply the exposure-reduction steps below in the meantime.

  3. Mitigate without a patch

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate

Red Hat product impact analysis is pending. Fedora ships busybox with CONFIG_FEATURE_HTTPD_PROXY enabled and is affected when P: reverse proxy rules are used. RHEL does not ship busybox as a standard package. The flaw applies only where httpd.conf defines P: directives that are meant to limit which backend URL paths…

Workaround published by Red Hat
Do not use BusyBox httpd P: rules as the sole path-based access control in front of sensitive backends. Remove P: lines if proxying is not required, or place a full reverse proxy (for example nginx or HAProxy) in front of the backend. Recompile with FEATURE_HTTPD_PROXY disabled if the applet is not needed.
Source: Red Hat security advisory for CVE-2026-88829 (CC BY 4.0)

Frequently Asked Questions

A flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy.
O3 Security · Impact-Aware SCA

Is CVE-2026-88829 in your dependencies?

Find it across , including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-88829: Red Hat (High 7.2)